opnsense opnsense

Name: opnsense opnsense
Brand: opnsense

productUS

cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

by severity

5critical5high15medium0low

updated 2026-10-28

vulnerabilities (36)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-50989US	—	10.9% (96th)	—	25.1.8	2025-08-27	< 25.1.8
CVE-2026-44194US	—	5.67% (93rd)	—	26.1.8	2026-05-13	< 26.1.8
CVE-2023-39001US	critical9.8	3.63% (89th)	—	23.7	2023-08-09	< 23.7
CVE-2019-11816US	high7.2	3.21% (88th)	—	19.1.8	2019-05-20	< 19.1.8
CVE-2023-39008US	critical9.8	3.12% (88th)	—	23.7	2023-08-09	< 23.7
CVE-2020-23015US	medium6.1	2.68% (86th)	—	no fix	2021-05-03	≤ 20.1.5
CVE-2023-39007US	critical9.6	2.61% (85th)	—	23.7	2023-08-09	< 23.7
CVE-2023-38997US	high7.2	1.37% (72nd)	—	23.7	2023-08-09	< 23.7
CVE-2021-42770US	medium6.1	1.37% (72nd)	—	21.7.4	2021-11-08	2 versions
CVE-2023-39002US	medium6.1	1.20% (68th)	—	23.7	2023-08-09	< 23.7
CVE-2023-27152US	critical9.8	1.11% (66th)	—	no fix	2023-10-23	= 23.1
CVE-2023-39004US	critical9.8	0.99% (62nd)	—	23.7	2023-08-09	< 23.7
CVE-2023-39003US	high7.5	0.79% (56th)	—	23.7	2023-08-09	< 23.7
CVE-2023-39005US	high7.5	0.72% (54th)	—	23.7	2023-08-09	< 23.7
CVE-2026-44193US	—	0.69% (52nd)	—	26.1.7	2026-05-13	< 26.1.7
CVE-2018-18958US	medium6.5	0.63% (50th)	—	18.7.7	2019-06-17	18.7.0 → 18.7.7
CVE-2023-44276US	medium5.4	0.60% (49th)	—	23.7.5	2023-09-28	< 23.7.5
CVE-2023-44275US	medium5.4	0.60% (49th)	—	23.7.5	2023-09-28	< 23.7.5
CVE-2023-38998US	medium6.1	0.59% (48th)	—	23.7	2023-08-09	< 23.7
CVE-2023-39000US	medium6.1	0.57% (47th)	—	23.7	2023-08-09	< 23.7
CVE-2026-45158US	—	0.53% (45th)	—	26.1.8	2026-05-13	< 26.1.8
CVE-2023-39006US	medium5.4	0.48% (41st)	—	23.7	2023-08-09	< 23.7
CVE-2019-25376US	—	0.42% (36th)	—	no fix	2026-02-15	= 19.1
CVE-2019-25375US	—	0.42% (36th)	—	no fix	2026-02-15	= 19.1
CVE-2026-34578US	—	0.41% (36th)	—	26.1.6	2026-04-09	< 26.1.6
CVE-2023-38999US	medium6.5	0.40% (34th)	—	23.7	2023-08-09	< 23.7
CVE-2019-25374US	—	0.37% (31st)	—	no fix	2026-02-15	= 19.1
CVE-2026-44195US	medium6.5	0.32% (25th)	—	26.1.7	2026-05-13	< 26.1.7
CVE-2019-25372US	—	0.29% (21st)	—	no fix	2026-02-15	= 19.1
CVE-2019-25371US	—	0.29% (21st)	—	no fix	2026-02-15	= 19.1
CVE-2019-25377US	medium6.1	0.28% (20th)	—	no fix	2026-02-15	= 19.1
CVE-2019-25370US	—	0.28% (20th)	—	no fix	2026-02-15	= 19.1
CVE-2019-25373US	medium5.4	0.24% (15th)	—	no fix	2026-02-15	= 19.1
CVE-2019-25369US	medium5.4	0.24% (15th)	—	no fix	2026-02-15	= 19.1
CVE-2026-30868US	high8.1	0.15% (4th)	—	26.1.4	2026-03-11	< 26.1.4
CVE-2019-25368US	medium5.4	0.15% (4th)	—	no fix	2026-02-15	= 19.1

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')17 CVEs
CWE-732Incorrect Permission Assignment for Critical Resource3 CVEs
CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')3 CVEs
CWE-307Improper Restriction of Excessive Authentication Attempts2 CVEs
CWE-352Cross-Site Request Forgery (CSRF)2 CVEs
CWE-601URL Redirection to Untrusted Site ('Open Redirect')2 CVEs
CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')2 CVEs
CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')2 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE36 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan