Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

55 records

Vendor: opnsense Clear all filters
TI-2026-85374 CVE-2026-123025 · GHSA-g9hg-38vq-jvh9

OS command injection in OPNsense os-acme-client Google Cloud DNS

Priority MEDIUM 41

An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.0063 Published 2026-11-05 No fix listed CWE-78
TI-2026-83024 CVE-2026-119560 · GHSA-2h55-2m98-rp29

OPNsense core NTP configuration injection via GPS and PPS fudge fields

Priority LOW 27

OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00344 Published 2026-10-30 No fix listed CWE-93
TI-2026-83004 CVE-2026-119425 · GHSA-48x9-g485-9vgw

OPNsense core Captive Portal Session Takeover via Forged ARP

Priority LOW 24

OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated…

CVSS 4.0MEDIUM 5.3 Adjacent network No auth No interaction EPSS 0.00313 Published 2026-10-30 No fix listed CWE-290
TI-2026-83003 CVE-2026-119424 · GHSA-r639-jmpp-wf8p

Configuration line injection in OPNsense wireless WPA settings

Priority LOW 30

OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privilege to inject directives by embedding CR/LF characters in WPA fields.

CVSS 4.0MEDIUM 6.1 Network Low privileges No interaction EPSS 0.00424 Published 2026-10-30 Fixed in 26.7.8 CWE-93
TI-2026-83002 CVE-2026-119423 · GHSA-m68j-m67p-c39j

Log injection in OPNsense lets attackers lock out victim IP addresses

Priority LOW 37

OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00376 Published 2026-10-30 Fixed in 26.7.8 CWE-117
TI-2026-82992 CVE-2026-119409 · GHSA-q3x8-9859-gj9r

Command injection in OPNsense firmware mirror setting allows root access

Priority MEDIUM 44

OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as root by storing a malicious firmware mirror URL.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.02477 Published 2026-10-30 Fixed in 26.7.8 CWE-78
TI-2026-80283 CVE-2026-115425 · GHSA-r7pm-f75m-q6jc

Multiple cross-site scripting in OPNsense firewall

Priority LOW 25

Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall vesrion 26.7.1_1 and earlier allows low privileged attacker to execute Javascript in the context of another user visiting a specific page or cl…

CVSS 4.0MEDIUM 5.6 Network Low privileges User interaction EPSS 0.00295 Published 2026-10-26 Fixed in 26.7.7 CWE-79
TI-2026-38642 CVE-2026-53581

ntp: write path traversal

Priority HIGH 72

OPNsense is a FreeBSD based firewall and routing platform.

CVSS 3.1CRITICAL 9.0 Network High privileges No interaction EPSS 0.00473 Published 2026-09-08 Fixed in 26.1.9, 26.4_20 CWE-22
TI-2026-32173 CVE-2026-44194

OPNsense: RCE on user managment

Priority HIGH 74

OPNsense is a FreeBSD based firewall and routing platform.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.05673 Published 2026-05-13 Fixed in 26.1.8 CWE-78
TI-2026-32174 CVE-2026-44195

OPNsense: Authentication lockout bypass

Priority HIGH 68

OPNsense is a FreeBSD based firewall and routing platform.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00318 Published 2026-05-13 Fixed in 26.1.7 CWE-307
Load more