Login Request a demo
CO
Product
core
by opnsense · last CVE Oct 15, 2026
17
CVEs
0
On KEV
9.9
Max CVSS
10
New 30D
Vulnerabilities17In the news4Timeline
Severity mix
Critical 5High 6Medium 6Low 0
Severity
All severities17Critical5High6Medium6Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add core to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-34578
8.2
0%
Apr 9
OPNsense has an LDAP Injection via Unsanitized Username in Authentication
Affected: < 26.1.6
CVE-2026-63442
8.1
0%
Oct 15
OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking
Affected: < 26.1.11
CVE-2026-30868
8.1
0%
Mar 11
Cross-Site Request Forgery (CSRF) in opnsense/core
Affected: < 26.1.4
CVE-2026-58390
8.0
1%
Oct 15
OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views
Affected: < 26.1.11
CVE-2026-71490
7.1
0%
Oct 15
OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection
Affected: < 26.1.11
CVE-2026-53582
7.1
1%
Oct 15
OPNsense: XPATH Injection can disclose any secret in config.xml
Affected: < 26.1.10
Showing 6