O
Vendor security profile
opnsense
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs14
Critical2
CISA KEV0
Public exploit9
Patch rate%14
Avg. CVSS6.7
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
2
0
10
CVE KEV
CVE severity distribution
14toplam CVE
Critical2 (14%)
High5 (36%)
Medium7 (50%)
Patch and exploitation view
%14
Verified patch
%0
CISA KEV
%64
Public exploit
2Patch available
0Partial
0Workaround
0Vendor: no patch
12Unknown
Latest vulnerabilities
7.1
CVE-2026-71490
OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection
O
Patch status unknown
8.1
CVE-2026-63442
OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking
O
Patch status unknown
8.0
CVE-2026-58390
OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views
O
Patch status unknown
5.2
CVE-2026-58394
OPNsense: Stored XSS in Administration Settings via Certificate Description
O
Patch status unknown
5.4
CVE-2026-58392
OPNsense: Stored XSS in Services: NTP GPS
O
Patch status unknown
4.3
CVE-2026-58395
OPNsense: XPath injection in MVC safe-delete
O
Patch status unknown
5.9
CVE-2026-58393
OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated CSO files
O
Patch status unknown
9.9
CVE-2026-57155
OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer
O
Patch status unknown Public Exploits:1
5.4
CVE-2026-58391
OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout
O
Patch status unknown
7.1
CVE-2026-53582
OPNsense: XPATH Injection can disclose any secret in config.xml
O
Patch status unknown Public Exploits:1