Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

Opnsense — Vulnerabilities & Security Advisories 17

Browse all 17 CVE security advisories affecting Opnsense. AI-powered Chinese analysis, POCs, and references for each vulnerability.

OPNsense serves as a firewall and routing platform primarily for network security and traffic management. Historically, vulnerabilities have included remote code execution, cross-site scripting, and privilege escalation, often stemming from web interface components or authentication flaws. The platform maintains a security-focused design with regular updates and a modular architecture. While no major public incidents have been widely documented, the 13 recorded CVEs highlight potential risks in areas like API endpoints and service configurations. Its open-source nature allows for community scrutiny but also requires diligent patch management to address emerging threats in network security appliances.

Top products by Opnsense: OPNsense core
CVE IDTitleCVSSSeverityPublished
CVE-2026-45158 OPNsense: Command Injection via Attacker-Controlled DHCP Config — coreCWE-88 9.1 Critical2026-05-13
CVE-2026-44194 OPNsense: RCE on user managment — coreCWE-78 9.1 Critical2026-05-13
CVE-2026-44195 OPNsense: Authentication lockout bypass — coreCWE-307 5.3 Medium2026-05-13
CVE-2026-44193 OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method — coreCWE-88 9.1 Critical2026-05-13
CVE-2026-34578 OPNsense has an LDAP Injection via Unsanitized Username in Authentication — coreCWE-90 8.2 High2026-04-09
CVE-2026-30868 Cross-Site Request Forgery (CSRF) in opnsense/core — coreCWE-352 6.3 Medium2026-03-11
CVE-2019-25377 OPNsense 19.1 Reflected XSS via system_advanced_sysctl.php — OPNsenseCWE-79 5.4 Medium2026-02-15
CVE-2019-25376 OPNsense 19.1 Reflected XSS via proxy endpoint — OPNsenseCWE-79 6.1 Medium2026-02-15
CVE-2019-25375 OPNsense 19.1 Reflected XSS via monit interface — OPNsenseCWE-79 6.1 Medium2026-02-15
CVE-2019-25374 OPNsense 19.1 Reflected XSS via vpn_ipsec_settings.php — OPNsenseCWE-79 6.1 Medium2026-02-15
CVE-2019-25373 OPNsense 19.1 Stored XSS via firewall_rules_edit.php — OPNsenseCWE-79 6.4 Medium2026-02-15
CVE-2019-25372 OPNsense 19.1 Reflected XSS via diag_traceroute.php — OPNsenseCWE-79 6.1 Medium2026-02-15
CVE-2019-25371 OPNsense 19.1 Reflected XSS via diag_ping.php — OPNsenseCWE-79 6.1 Medium2026-02-15
CVE-2019-25370 OPNsense 19.1 Reflected XSS via interfaces_vlan_edit.php — OPNsenseCWE-79 6.1 Medium2026-02-15
CVE-2019-25369 OPNsense 19.1 Stored XSS via system_advanced_sysctl.php — OPNsenseCWE-79 6.4 Medium2026-02-15
CVE-2019-25368 OPNsense 19.1 Reflected XSS via diag_backup.php — OPNsenseCWE-79 5.4 Medium2026-02-15
CVE-2025-50989 OPNsense 安全漏洞 — OPNsenseCWE-78 9.1 Critical2025-08-27

This page lists every published CVE security advisory associated with Opnsense. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.