OP
Product
OPNsense
36
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 9High 6Medium 21Low 0
Watch
Add OPNsense to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-44195 | 6.5 | May 13 | OPNsense: Authentication lockout bypass Affected: before 26.1.7 |
| CVE-2023-38999 | 6.5 | Aug 9 | A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to cause a… Affected: before 23.7 |
| CVE-2018-18958 | 6.5 | Jun 17 | OPNsense 18.7.x before 18.7.7 has Incorrect Access Control Affected: 18.7.0 before 18.7.7 |
| CVE-2019-25377 | 6.1 | Feb 15 | OPNsense 19.1 Reflected XSS via system_advanced_sysctl.php Affected: 19.1 |
| CVE-2019-25376 | 6.1 | Feb 15 | OPNsense 19.1 Reflected XSS via proxy endpoint Affected: 19.1 |
| CVE-2019-25375 | 6.1 | Feb 15 | OPNsense 19.1 Reflected XSS via monit interface Affected: 19.1 |
| CVE-2019-25374 | 6.1 | Feb 15 | OPNsense 19.1 Reflected XSS via vpn_ipsec_settings.php Affected: 19.1 |
| CVE-2019-25372 | 6.1 | Feb 15 | OPNsense 19.1 Reflected XSS via diag_traceroute.php Affected: 19.1 |
| CVE-2019-25371 | 6.1 | Feb 15 | OPNsense 19.1 Reflected XSS via diag_ping.php Affected: 19.1 |
| CVE-2019-25370 | 6.1 | Feb 15 | OPNsense 19.1 Reflected XSS via interfaces_vlan_edit.php Affected: 19.1 |
| CVE-2023-39002 | 6.1 | Aug 9 | A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows… Affected: before 23.7 |
| CVE-2023-39000 | 6.1 | Aug 9 | A reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows… Affected: before 23.7 |
| CVE-2023-38998 | 6.1 | Aug 9 | An open redirect in the Login page of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to redirect a victim user to an arbitrary web site… Affected: before 23.7 |
| CVE-2021-42770 | 6.1 | Nov 8 | A Cross-site scripting (XSS) vulnerability was discovered in OPNsense before 21.7.4 via the LDAP attribute return in the authentication tester Affected: through 19.7.0; 21.7.0 before 21.7.4 |
| CVE-2020-23015 | 6.1 | May 3 | An open redirect issue was discovered in OPNsense through 20.1.5 Affected: through 20.1.5 |
| CVE-2019-25373 | 5.4 | Feb 15 | OPNsense 19.1 Stored XSS via firewall_rules_edit.php Affected: 19.1 |
| CVE-2019-25369 | 5.4 | Feb 15 | OPNsense 19.1 Stored XSS via system_advanced_sysctl.php Affected: 19.1 |
| CVE-2019-25368 | 5.4 | Feb 15 | OPNsense 19.1 Reflected XSS via diag_backup.php Affected: 19.1 |
| CVE-2023-44276 | 5.4 | Sep 28 | OPNsense before 23.7.5 allows XSS via the index.php sequence parameter to the Lobby Dashboard Affected: before 23.7.5 |
| CVE-2023-44275 | 5.4 | Sep 28 | OPNsense before 23.7.5 allows XSS via the index.php column_count parameter to the Lobby Dashboard Affected: before 23.7.5 |
| CVE-2023-39006 | 5.4 | Aug 9 | The Crash Reporter (crash_reporter.php) component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 mishandles input sanitization Affected: before 23.7 |
Showing 21