Known vulnerabilities in OPNsense

Vendor: Deciso
Software: OPNsense
Software CPE: cpe:2.3:a:deciso:opnsense:*:*:*:*:*:*:*:*
Total vulnerabilities: 36
Public exploits: 8
Known exploited (KEV): 0

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting OPNsense OPNsense is affected by 36 known vulnerabilities: 1 high, 11 medium, 24 low Critical High Medium Low

Vulnerabilities (36)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU142552 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
26.7.2 14.08.2026 SB20260814122
#VU142553 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
26.7.2 14.08.2026 SB20260814122
#VU142554 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
26.7.2 14.08.2026 SB20260814122
#VU142555 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
26.7.2 14.08.2026 SB20260814122
#VU142551 - Command injection
CWE-77 Low
No
No
26.7.2 14.08.2026 SB20260814122
#VU142550 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
26.7.2 14.08.2026 SB20260814122
#VU139366 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
26.7.1 26.07.2026 SB2026072602
#VU139367 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
26.7.1 26.07.2026 SB2026072602
#VU139368 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
26.7.1 26.07.2026 SB2026072602
#VU139369 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
26.7.1 26.07.2026 SB2026072602
#VU139365 - Authorization Bypass Through User-Controlled Key
CWE-639 Low
No
No
26.7.1 26.07.2026 SB2026072602
#VU139364 - Incorrect Authorization
CWE-863 Low
No
No
26.7.1 26.07.2026 SB2026072602
#VU139363 - Resource exhaustion
CWE-400 Medium
No
No
26.7.1 26.07.2026 SB2026072602
#VU134540 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 Medium
No
No
26.1.10 15.06.2026 SB2026061548
#VU134541 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 Medium
No
No
26.1.10 15.06.2026 SB2026061548
#VU134539 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
26.1.10 15.06.2026 SB2026061548
#VU134538 - Improper Neutralization of Data within XPath Expressions
CVE-2026-53582
CWE-643 Low
No
No
26.1.10 15.06.2026 SB2026061548
#VU131109 - Argument Injection or Modification
CVE-2026-45158
CWE-88 Medium
No
No
26.1.8 12.05.2026 SB2026051223
#VU131108 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-44194
CWE-78 Low
No
No
26.1.8 12.05.2026 SB2026051223
#VU125579 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
CVE-2026-34578
CWE-90 High
No
No
26.1.6 09.04.2026 SB2026040955


Showing elements 1 - 20 out of 36