Product by Open Source

    Opnsense

    12 known vulnerabilities in Opnsense (Open Source), 0 of them actively exploited (CISA KEV).

    Key figures

    12

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    3

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Opnsense (Open Source)
    CriticalCVE-2026-57155

    OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer

    also in 1 other product

    		9.9
    HighCVE-2026-53582

    OPNsense: XPATH Injection can disclose any secret in config.xml

    also in 1 other product

    		7.1
    CriticalCVE-2026-53581

    ntp: write path traversal

    also in 1 other product

    		9.0
    MediumCVE-2026-58393

    OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated CSO files

    also in 1 other product

    		5.9
    MediumCVE-2026-115425

    Multiple cross-site scripting (XSS) in OPNsense

    also in 1 other product

    		—
    CriticalCVE-2026-57154

    open source OPNsense: security vulnerability

    		—
    MediumCVE-2026-58391

    OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout

    also in 1 other product

    		5.4
    MediumCVE-2026-58392

    OPNsense: Stored XSS in Services: NTP GPS

    also in 1 other product

    		5.4
    MediumCVE-2026-58395

    OPNsense: XPath injection in MVC safe-delete

    also in 1 other product

    		4.3
    MediumCVE-2026-58394

    OPNsense: Stored XSS in Administration Settings via Certificate Description

    also in 1 other product

    		5.2
    MediumCVE-2026-49131

    OPNsense < 26.1.9 Stored XSS via Firewall Rule Description Field

    		5.4
    MediumCVE-2026-49132

    OPNsense < 26.1.9 Stored XSS via Certificate Description Field

    		5.4

    All products by Open Source