Skip to content
OpenAdvisories

Vendor

opnsense

36 known vulnerabilities.

Products

core 23 OPNsense 11 os-acme-client 1 OPNsense firewall 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.4
    CVE-2026-123025 Public exploit

    An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-…

    opnsense os-acme-client
  • Critical 9.9
    CVE-2026-57155 Public exploit

    OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer

    OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to cons…

    opnsense core
  • High 7.1
    CVE-2026-53582 Public exploit

    OPNsense: XPATH Injection can disclose any secret in config.xml

    OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPN…

    opnsense core