Known vulnerabilities in OPNsense - page 2

Vendor: Deciso
Software: OPNsense
Software CPE: cpe:2.3:a:deciso:opnsense:*:*:*:*:*:*:*:*
Total vulnerabilities: 36
Public exploits: 8
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.8

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting OPNsense OPNsense is affected by 36 known vulnerabilities: 1 high, 11 medium, 24 low Critical High Medium Low

Vulnerabilities (36)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU136897 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-57155
CWE-78 Medium
No
No
26.1.11, 26.4.1p1 03.07.2026 SB2026070359
#VU136839 - Improper Output Neutralization for Logs
CWE-117 Medium
Available
No
26.1.11, 26.4.1p1 03.07.2026 SB2026070359
#VU136831 - Incorrect Authorization
CWE-863 Medium
Available
No
26.1.11, 26.4.1p1 03.07.2026 SB2026070359
#VU134542 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 Medium
No
No
26.1.9 15.06.2026 SB2026061549
#VU134540 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 Medium
No
No
26.1.10 15.06.2026 SB2026061548
#VU134541 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 Medium
No
No
26.1.10 15.06.2026 SB2026061548
#VU134539 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
26.1.10 15.06.2026 SB2026061548
#VU134538 - Improper Neutralization of Data within XPath Expressions
CVE-2026-53582
CWE-643 Low
No
No
26.1.10 15.06.2026 SB2026061548
#VU131109 - Argument Injection or Modification
CVE-2026-45158
CWE-88 Medium
No
No
26.1.8 12.05.2026 SB2026051223
#VU131108 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-44194
CWE-78 Low
No
No
26.1.8 12.05.2026 SB2026051223
#VU129775 - Improper Restriction of Excessive Authentication Attempts
CWE-307 Medium
No
No
26.1.7 05.05.2026 SB2026050564
#VU129774 - Argument Injection or Modification
CVE-2026-44193
CWE-88 Low
No
No
26.1.7 05.05.2026 SB2026050564
#VU125579 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
CVE-2026-34578
CWE-90 High
No
No
26.1.6 09.04.2026 SB2026040955
#VU125578 - Cross-Site Request Forgery (CSRF)
CVE-2026-30868
CWE-352 Low
No
No
26.1.4 09.04.2026 SB2026040954
#VU122803 - Command injection
CVE-2026-2035
CWE-77 Low
No
No
- 13.02.2026 SB2026021330
#VU119097 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2025-13698
CWE-22 Low
No
No
- 03.12.2025 SB2025120322


Showing elements 21 - 40 out of 36