OP
Product
OPNsense
36
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 9High 6Medium 21Low 0
Watch
Add OPNsense to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-27152 | 9.8 | Oct 23 | DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers to perform a brute-force attack to bypass authentication Affected: 23.1 |
| CVE-2023-39008 | 9.8 | Aug 9 | A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to… Affected: before 23.7 |
| CVE-2023-39004 | 9.8 | Aug 9 | Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive… Affected: before 23.7 |
| CVE-2023-39001 | 9.8 | Aug 9 | A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute… Affected: before 23.7 |
| CVE-2023-39007 | 9.6 | Aug 9 | /ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAction in… Affected: before 23.7 |
| CVE-2026-45158 | 9.1 | May 13 | OPNsense: Command Injection via Attacker-Controlled DHCP Config Affected: before 26.1.8 |
| CVE-2026-44194 | 9.1 | May 13 | OPNsense: RCE on user managment Affected: before 26.1.8 |
| CVE-2026-44193 | 9.1 | May 13 | OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method Affected: before 26.1.7 |
| CVE-2025-50989 | 9.1 | Aug 27 | OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edit.php) Affected: before 25.1.8 |
| CVE-2026-34578 | 8.2 | Apr 9 | OPNsense has an LDAP Injection via Unsanitized Username in Authentication Affected: before 26.1.6 |
| CVE-2026-30868 | 8.1 | Mar 11 | Cross-Site Request Forgery (CSRF) in opnsense/core Affected: before 26.1.4 |
| CVE-2023-39005 | 7.5 | Aug 9 | Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 Affected: before 23.7 |
| CVE-2023-39003 | 7.5 | Aug 9 | OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permissions in the directory /tmp Affected: before 23.7 |
| CVE-2023-38997 | 7.2 | Aug 9 | A directory traversal vulnerability in the Captive Portal templates of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute… Affected: before 23.7 |
| CVE-2019-11816 | 7.2 | May 20 | Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote authenticated users to escalate privileges to administrator via… Affected: before 19.1.8 |
| CVE-2026-44195 | 6.5 | May 13 | OPNsense: Authentication lockout bypass Affected: before 26.1.7 |
| CVE-2023-38999 | 6.5 | Aug 9 | A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to cause a… Affected: before 23.7 |
| CVE-2018-18958 | 6.5 | Jun 17 | OPNsense 18.7.x before 18.7.7 has Incorrect Access Control Affected: 18.7.0 before 18.7.7 |
| CVE-2019-25377 | 6.1 | Feb 15 | OPNsense 19.1 Reflected XSS via system_advanced_sysctl.php Affected: 19.1 |
| CVE-2019-25376 | 6.1 | Feb 15 | OPNsense 19.1 Reflected XSS via proxy endpoint Affected: 19.1 |
| CVE-2019-25375 | 6.1 | Feb 15 | OPNsense 19.1 Reflected XSS via monit interface Affected: 19.1 |
| CVE-2019-25374 | 6.1 | Feb 15 | OPNsense 19.1 Reflected XSS via vpn_ipsec_settings.php Affected: 19.1 |
| CVE-2019-25372 | 6.1 | Feb 15 | OPNsense 19.1 Reflected XSS via diag_traceroute.php Affected: 19.1 |
| CVE-2019-25371 | 6.1 | Feb 15 | OPNsense 19.1 Reflected XSS via diag_ping.php Affected: 19.1 |
| CVE-2019-25370 | 6.1 | Feb 15 | OPNsense 19.1 Reflected XSS via interfaces_vlan_edit.php Affected: 19.1 |
| CVE-2023-39002 | 6.1 | Aug 9 | A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows… Affected: before 23.7 |
| CVE-2023-39000 | 6.1 | Aug 9 | A reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows… Affected: before 23.7 |
| CVE-2023-38998 | 6.1 | Aug 9 | An open redirect in the Login page of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to redirect a victim user to an arbitrary web site… Affected: before 23.7 |
| CVE-2021-42770 | 6.1 | Nov 8 | A Cross-site scripting (XSS) vulnerability was discovered in OPNsense before 21.7.4 via the LDAP attribute return in the authentication tester Affected: through 19.7.0; 21.7.0 before 21.7.4 |
| CVE-2020-23015 | 6.1 | May 3 | An open redirect issue was discovered in OPNsense through 20.1.5 Affected: through 20.1.5 |
| CVE-2019-25373 | 5.4 | Feb 15 | OPNsense 19.1 Stored XSS via firewall_rules_edit.php Affected: 19.1 |
| CVE-2019-25369 | 5.4 | Feb 15 | OPNsense 19.1 Stored XSS via system_advanced_sysctl.php Affected: 19.1 |
| CVE-2019-25368 | 5.4 | Feb 15 | OPNsense 19.1 Reflected XSS via diag_backup.php Affected: 19.1 |
| CVE-2023-44276 | 5.4 | Sep 28 | OPNsense before 23.7.5 allows XSS via the index.php sequence parameter to the Lobby Dashboard Affected: before 23.7.5 |
| CVE-2023-44275 | 5.4 | Sep 28 | OPNsense before 23.7.5 allows XSS via the index.php column_count parameter to the Lobby Dashboard Affected: before 23.7.5 |
| CVE-2023-39006 | 5.4 | Aug 9 | The Crash Reporter (crash_reporter.php) component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 mishandles input sanitization Affected: before 23.7 |
Showing 36