opnsense core vulnerabilities

Newest CVEs

• CVE-2026-57154

  OPNsense: Configuration line injection via multiple GUI text fields

  opnsense · core

  High8.1
• CVE-2026-119560

  OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields

  opnsense · core

  Medium6.0
• CVE-2026-119425

  OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP

  opnsense · core

  Medium5.3
• CVE-2026-119424

  OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity

  opnsense · core

  Medium6.1
• CVE-2026-119423

  OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username

  opnsense · core

  Medium6.9
• CVE-2026-119409

  OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting

  opnsense · core

  High8.6
• CVE-2026-71490

  OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection

  opnsense · core

  High7.1
• CVE-2026-63442

  OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking

  opnsense · core

  High8.1
• CVE-2026-58390

  OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views

  opnsense · core

  High8.0
• CVE-2026-58394

  OPNsense: Stored XSS in Administration Settings via Certificate Description

  opnsense · core

  Medium5.2