Known vulnerabilities in OPNsense

Vendor: Deciso
Software: OPNsense
Software CPE: cpe:2.3:a:deciso:opnsense:*:*:*:*:*:*:*:*
Total vulnerabilities: 36
Public exploits: 8
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.8

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting OPNsense OPNsense is affected by 36 known vulnerabilities: 1 high, 11 medium, 24 low Critical High Medium Low

Vulnerabilities (36)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU142552 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
26.7.2 14.08.2026 SB20260814122
#VU142553 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
26.7.2 14.08.2026 SB20260814122
#VU142554 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
26.7.2 14.08.2026 SB20260814122
#VU142555 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
26.7.2 14.08.2026 SB20260814122
#VU142551 - Command injection
CWE-77 Low
No
No
26.7.2 14.08.2026 SB20260814122
#VU142550 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
26.7.2 14.08.2026 SB20260814122
#VU139366 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
26.7.1 26.07.2026 SB2026072602
#VU139367 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
26.7.1 26.07.2026 SB2026072602
#VU139368 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
26.7.1 26.07.2026 SB2026072602
#VU139369 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
26.7.1 26.07.2026 SB2026072602
#VU139365 - Authorization Bypass Through User-Controlled Key
CWE-639 Low
No
No
26.7.1 26.07.2026 SB2026072602
#VU139364 - Incorrect Authorization
CWE-863 Low
No
No
26.7.1 26.07.2026 SB2026072602
#VU139363 - Resource exhaustion
CWE-400 Medium
No
No
26.7.1 26.07.2026 SB2026072602
#VU136838 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-58394
CWE-79 Low
Available
No
26.1.11, 26.4.1p1 03.07.2026 SB2026070359
#VU136837 - Improper Neutralization of Data within XPath Expressions
CVE-2026-58395
CWE-643 Low
Available
No
26.1.11, 26.4.1p1 03.07.2026 SB2026070359
#VU136836 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-58392
CWE-79 Low
Available
No
26.1.11, 26.4.1p1 03.07.2026 SB2026070359
#VU136835 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-58391
CWE-79 Low
Available
No
26.1.11, 26.4.1p1 03.07.2026 SB2026070359
#VU136834 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-58390
CWE-79 Low
No
No
26.1.11, 26.4.1p1 03.07.2026 SB2026070359
#VU136833 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-58393
CWE-22 Medium
Available
No
26.1.11, 26.4.1p1 03.07.2026 SB2026070359
#VU136832 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVE-2026-57154
CWE-93 Medium
Available
No
26.1.11, 26.4.1p1 03.07.2026 SB2026070359


Showing elements 1 - 20 out of 36