Login Request a demo
OP
Product
OPNsense
by Opnsense · last CVE May 13, 2026
36
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities36In the news0Timeline
Severity mix
Critical 9High 6Medium 21Low 0
Severity
All severities36Critical9High6Medium21Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add OPNsense to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2023-27152
9.8
1%
Oct 23
DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers to perform a brute-force attack to bypass authentication
Affected: 23.1
CVE-2023-39008
9.8
3%
Aug 9
A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to…
Affected: before 23.7
CVE-2023-39004
9.8
1%
Aug 9
Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive…
Affected: before 23.7
CVE-2023-39001
9.8
4%
Aug 9
A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute…
Affected: before 23.7
CVE-2023-39007
9.6
3%
Aug 9
/ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAction in…
Affected: before 23.7
CVE-2026-45158
9.1
1%
May 13
OPNsense: Command Injection via Attacker-Controlled DHCP Config
Affected: before 26.1.8
CVE-2026-44194
9.1
6%
May 13
OPNsense: RCE on user managment
Affected: before 26.1.8
CVE-2026-44193
9.1
1%
May 13
OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method
Affected: before 26.1.7
CVE-2025-50989
9.1
11%
Aug 27
OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edit.php)
Affected: before 25.1.8
Showing 9