Vendor

    Opnsense

    48 known vulnerabilities in products by Opnsense, 0 of them actively exploited (CISA KEV).

    Key figures

    48

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    11

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Opnsense
    CriticalCVE-2026-44194

    OPNsense: RCE on user managment

    		9.1
    CriticalCVE-2025-50989

    OPNsense: OS Command Injection

    		9.1
    CriticalCVE-2023-39001

    OPNsense: Command Injection

    		9.8
    CriticalCVE-2023-39008

    OPNsense: Command Injection

    		9.8
    CriticalCVE-2023-39007

    OPNsense: Cross-Site Scripting (XSS)

    		9.6
    CriticalCVE-2026-57155

    OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer

    also in 1 other product

    		9.9
    HighCVE-2019-11816

    Netgate pfSense: Improper Access Control

    also in 1 other product

    		7.2
    MediumCVE-2020-23015

    OPNsense: Open Redirect

    		6.1
    HighCVE-2026-58390

    OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views

    		8.0
    HighCVE-2026-53582

    OPNsense: XPATH Injection can disclose any secret in config.xml

    also in 1 other product

    		7.1
    CriticalCVE-2023-27152

    OPNsense: Authentication Bypass

    		9.8
    CriticalCVE-2026-44193

    OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method

    		9.1
    CriticalCVE-2026-53581

    ntp: write path traversal

    also in 1 other product

    		9.0
    CriticalCVE-2023-39004

    OPNsense: Privilege Escalation

    		9.8
    HighCVE-2023-38997

    OPNsense: Path Traversal

    		7.2
    CriticalCVE-2026-45158

    OPNsense: Command Injection via Attacker-Controlled DHCP Config

    		9.1
    HighCVE-2026-63442

    OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking

    		8.1
    HighCVE-2026-71490

    OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection

    		7.1
    MediumCVE-2021-42770

    OPNsense: Cross-Site Scripting (XSS)

    		6.1
    MediumCVE-2023-39002

    OPNsense: Cross-Site Scripting (XSS)

    		6.1
    MediumCVE-2026-58393

    OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated CSO files

    also in 1 other product

    		5.9
    HighCVE-2026-34578

    OPNsense has an LDAP Injection via Unsanitized Username in Authentication

    		8.2
    HighCVE-2023-39003

    OPNsense: security vulnerability

    		7.5
    HighCVE-2023-39005

    OPNsense: security vulnerability

    		7.5
    MediumCVE-2026-115425

    Multiple cross-site scripting (XSS) in OPNsense

    also in 1 other product

    		—

    All vulnerabilities in search

    Products

    Products by Opnsense
    OPNsense360
    Core170