CVE-2026-45158 | Critical | 9.1 | 2026-05-13 | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the configured interf… |
CVE-2026-44195 | Medium | 5.3 | 2026-05-13 | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, a logic flaw in the OPNsense lockout_handler allows an unauthenticated attacker to… |
CVE-2026-44194 | Critical | 9.1 | 2026-05-13 | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an authenticated Remote Code Execution (RCE) vulnerability in the OPNsense core all… |
CVE-2026-44193 | Critical | 9.1 | 2026-05-13 | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied i… |
CVE-2026-34578 | High | 8.2 | 2026-04-09 | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.6, OPNsense's LDAP authentication connector passes the login username directly into an… |
CVE-2026-30868 | Medium | 6.3 | 2026-03-11 | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.4, multiple OPNsense MVC API endpoints perform state‑changing operations but are acces… |
CVE-2019-25377 | Medium | 5.4 | 2026-02-15 | OPNsense 19.1 contains a reflected cross-site scripting vulnerability in the system_advanced_sysctl.php endpoint that allows attackers to inject malicious scri… |
CVE-2019-25376 | Medium | 6.1 | 2026-02-15 | OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted p… |
CVE-2019-25375 | Medium | 6.1 | 2026-02-15 | OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted i… |
CVE-2019-25374 | Medium | 6.1 | 2026-02-15 | OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting the passthrough_networks… |
CVE-2019-25373 | Medium | 6.4 | 2026-02-15 | OPNsense 19.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input… |
CVE-2019-25372 | Medium | 6.1 | 2026-02-15 | OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting insuffici… |
CVE-2019-25371 | Medium | 6.1 | 2026-02-15 | OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting insuffici… |
CVE-2019-25370 | Medium | 6.1 | 2026-02-15 | OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input through mul… |
CVE-2019-25369 | Medium | 6.4 | 2026-02-15 | OPNsense 19.1 contains a stored cross-site scripting vulnerability in the system_advanced_sysctl.php endpoint that allows attackers to inject persistent malici… |
CVE-2019-25368 | Medium | 5.4 | 2026-02-15 | OPNsense 19.1 contains multiple cross-site scripting vulnerabilities in the diag_backup.php endpoint that allow attackers to inject malicious scripts through m… |
CVE-2025-50989 | Critical | 9.1 | 2025-08-27 | OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edit.php). The span P… |
CVE-2023-27152 | Critical | 9.8 | 2023-10-23 | DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers to perform a brute-force attack to bypass authentication. |
CVE-2023-44276 | Medium | 5.4 | 2023-09-28 | OPNsense before 23.7.5 allows XSS via the index.php sequence parameter to the Lobby Dashboard. |
CVE-2023-44275 | Medium | 5.4 | 2023-09-28 | OPNsense before 23.7.5 allows XSS via the index.php column_count parameter to the Lobby Dashboard. |
CVE-2023-39008 | Critical | 9.8 | 2023-08-09 | A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allo… |
CVE-2023-39007 | Critical | 9.6 | 2023-08-09 | /ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAction in app/controll… |
CVE-2023-39006 | Medium | 5.4 | 2023-08-09 | The Crash Reporter (crash_reporter.php) component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 mishandles input sanitization. |
CVE-2023-39005 | High | 7.5 | 2023-08-09 | Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2. |
CVE-2023-39004 | Critical | 9.8 | 2023-08-09 | Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to ac… |
CVE-2023-39003 | High | 7.5 | 2023-08-09 | OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permissions in the directory /tmp. |
CVE-2023-39002 | Medium | 6.1 | 2023-08-09 | A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense Community Edition before 23.7 and Business Edition before… |
CVE-2023-39001 | Critical | 9.8 | 2023-08-09 | A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attacker… |
CVE-2023-39000 | Medium | 6.1 | 2023-08-09 | A reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition… |
CVE-2023-38999 | Medium | 6.5 | 2023-08-09 | A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows a… |
CVE-2023-38998 | Medium | 6.1 | 2023-08-09 | An open redirect in the Login page of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to redirect a victim user to a… |
CVE-2023-38997 | High | 7.2 | 2023-08-09 | A directory traversal vulnerability in the Captive Portal templates of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attacke… |
CVE-2021-42770 | Medium | 6.1 | 2021-11-08 | A Cross-site scripting (XSS) vulnerability was discovered in OPNsense before 21.7.4 via the LDAP attribute return in the authentication tester. |
CVE-2020-23015 | Medium | 6.1 | 2021-05-03 | An open redirect issue was discovered in OPNsense through 20.1.5. The redirect parameter "url" in login page was not filtered and can redirect user to any webs… |
CVE-2018-18958 | Medium | 6.5 | 2019-06-17 | OPNsense 18.7.x before 18.7.7 has Incorrect Access Control. |
CVE-2019-11816 | High | 7.2 | 2019-05-20 | Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote authenticated users to escalate privileges t… |