opnsense vulnerabilities

CVEs per yearBy the year they were published

1. 20251
2. 202635

Newest CVEs

• CVE-2026-123025

  An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. The…

  OPNsense · os-acme-client

  Critical9.4
• CVE-2026-57154

  OPNsense: Configuration line injection via multiple GUI text fields

  opnsense · core

  High8.1
• CVE-2026-119560

  OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields

  opnsense · core

  Medium6.0
• CVE-2026-119425

  OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP

  opnsense · core

  Medium5.3
• CVE-2026-119424

  OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity

  opnsense · core

  Medium6.1
• CVE-2026-119423

  OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username

  opnsense · core

  Medium6.9
• CVE-2026-119409

  OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting

  opnsense · core

  High8.6
• CVE-2026-115425

  Multiple cross-site scripting (XSS) in OPNsense

  OPNsense · OPNsense firewall

  Medium5.6
• CVE-2026-71490

  OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection

  opnsense · core

  High7.1
• CVE-2026-63442

  OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking

  opnsense · core

  High8.1