Skip to contentOpnsense vulnerabilities
Newest
- home-assistant coreHome Assistant vulnerable to Stored XSS in Energy dashboard from Energy Entity NameCVE-2025-62172Fix available8.5 High
- flightphp flight, core +1 moreDenial of Service (DoS) vulnerability in mikecao/flightCVE-2014-1251277.5 High
- deciso opnsenseOPNsense 25.1 contains an authenticated command injection vulnerability in its Bridge Interface...CVE-2025-50989EPSS 10.9%9.1 Critical
- api-platform coreGraphQL grant on a property might be cached with different objectsCVE-2025-31485Fix available7.5 High
- api-platform coreGraphQL query operations security can be bypassedCVE-2025-31481Fix available7.5 High
- api-platform coreAPI Platform Core can leak exceptions message that may contain sensitive informationCVE-2023-47639Fix available5.3 Medium
- api-platform coreGraphQl securityAfterResolver not calledCVE-2025-23204Fix available4.4 Medium
- home-assistant coreSSL validation for outgoing requests in Home Assistant Core and used libs not correctCVE-2025-25305Fix available7.0 High
- home-assistant core, home-assistant +1 moreUser accounts disclosed to unauthenticated actors on the LANCVE-2023-50715Fix available4.3 Medium
- opnsenseDECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers to...CVE-2023-271529.8 Critical
- home-assistant core, home-assistant +1 moreAccount takeover via auth_callback login in Home Assistant CoreCVE-2023-41893Fix available4.3 Medium
- home-assistant core, home-assistant +1 moreLocal-only webhooks externally accessible via SniTun in Home Assistant CoreCVE-2023-418945.3 Medium
- home-assistant core, home-assistant +1 moreCross-site Scripting via auth_callback login in Home Assistant CoreCVE-2023-418958.8 High
- home-assistant core, home-assistant, home-assistant home-assistant-js-websocket +2 moreFake websocket server installation permits full takeover in Home Assistant CoreCVE-2023-418967.1 High
- home-assistant core, home-assistant +1 moreLack of XFO header allows clickjacking in Home Assistant CoreCVE-2023-418978.8 High
- home-assistant core, home-assistant +1 morePartial Server-Side Request Forgery in Home Assistant CoreCVE-2023-418996.6 Medium
- home-assistant home assistant companion, core +1 moreArbitrary URL load in Android WebView in `MyActivity.kt` in Home Assistant Companion for AndroidCVE-2023-41898Public exploit8.6 High
- home-assistant home assistant companion, core +1 moreClient-Side Request Forgery in Home Assistant iOS/macOS native AppsCVE-2023-443858.6 High
- opnsenseOPNsense before 23.7.5 allows XSS via the index.php sequence parameter to the Lobby Dashboard.CVE-2023-442765.4 Medium
- opnsenseOPNsense before 23.7.5 allows XSS via the index.php column_count parameter to the Lobby Dashboard.CVE-2023-442755.4 Medium
- drupal core, drupal +1 moreDrupal core - Critical - Cache poisoning - SA-CORE-2023-006CVE-2023-5256Fix available7.5 High
- opnsenseA command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense before...CVE-2023-390089.8 Critical
- opnsense/ui/cron/item/open in the Cron component of OPNsense before 23.7 allows XSS.CVE-2023-390079.6 Critical
- opnsenseThe Crash Reporter (crash_reporter.php) component of OPNsense before 23.7 mishandles input...CVE-2023-390065.4 Medium
- opnsenseInsecure permissions exist for configd.socket in OPNsense before 23.7.CVE-2023-390057.5 High
- opnsenseInsecure permissions in the configuration directory (/conf/) of OPNsense before 23.7 allow...CVE-2023-390049.8 Critical
- opnsenseOPNsense before 23.7 was discovered to contain insecure permissions in the directory /tmp.CVE-2023-390037.5 High
- opnsenseA cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in...CVE-2023-390026.1 Medium
- opnsenseA command injection vulnerability in the component diag_backup.php of OPNsense before 23.7 allows...CVE-2023-390019.8 Critical
- opnsenseA reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/...CVE-2023-390006.1 Medium
- opnsenseA Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense before 23.7...CVE-2023-389996.5 Medium
- opnsenseAn open redirect in the Login page of OPNsense before 23.7 allows attackers to redirect a victim...CVE-2023-389986.1 Medium
- opnsenseA directory traversal vulnerability in the Captive Portal templates of OPNsense before 23.7...CVE-2023-389977.2 High
- drupal core, drupal +1 moreDrupal core - Moderately critical - Access bypass - SA-CORE-2023-005CVE-2023-31250Fix available6.5 Medium
- home-assistant core, supervisor, home-assistant +2 moreCVE-2023-27482 in supervisor - Patched by RootCVE-2023-27482Fix availableEPSS 72.2%10.0 Critical
- api-platform coreSecured properties in API Platform Core may be accessible within collectionsCVE-2023-25575Fix available7.7 High
- drupal core, drupal +1 moreLack of domain validation in Druple coreCVE-2022-25276Fix available6.1 Medium
- drupal core, drupal +1 moreDrupal core arbitrary PHP code executionCVE-2022-25277Fix available7.2 High
- drupal core, drupal +1 moreDrupal core Denial of Service vulnerabilityCVE-2022-25278Fix available6.5 Medium
- drupal core, drupal +1 moreDrupal core Denial of Service vulnerabilityCVE-2022-25275Fix available7.5 High
- drupal core, drupal +1 moreAccess bypass in Drupal coreCVE-2022-25274Fix available5.4 Medium
- drupal core, drupal +1 moreDrupal core Denial of Service vulnerabilityCVE-2022-25273Fix available7.5 High
- drupal core, drupal +1 moreDrupal core Denial of Service vulnerabilityCVE-2022-25270Fix available6.5 Medium
- drupal core, drupal, fedoraproject fedora +2 moreDrupal core Denial of Service vulnerabilityCVE-2022-25271Fix available7.5 High
- drupal core, drupal +1 moreAccess bypass in Drupal Core 8/9CVE-2020-13668Fix available6.1 Medium
- opnsenseA Cross-site scripting (XSS) vulnerability was discovered in OPNsense before 21.7.4 via the LDAP attribute return in the authentication tester.CVE-2021-427706.1 Medium
- drupal core, drupal +1 moreDrupal core access bypass vulnerabilityCVE-2020-13677Fix available7.5 High
- drupal core, drupal +1 moreIncorrect Authorization in Drupal coreCVE-2020-13676Fix available6.5 Medium
- drupal core, drupal +1 moreUnrestricted Upload of File with Dangerous Type in Drupal coreCVE-2020-13675Fix available9.8 Critical
- drupal core, drupal +1 moreCross-Site Request Forgery in Drupal coreCVE-2020-13674Fix available6.5 Medium
- Show moreLoading…