Skip to contentOpnsense vulnerabilities
Newest
- opnsense, opnsense core +1 moreOPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` methodCVE-2026-441939.1 Critical
- ellanetworks coreElla Core: Handover failures during concurrent Security Mode CommandCVE-2026-44474Fix available3.7 Low
- ellanetworks coreElla Core: UE Security Capability bypass on NGAP PathSwitchRequestCVE-2026-44475Fix available6.1 Medium
- ellanetworks coreElla Core: UE Downlink Redirection via Forged PDUSessionResourceSetupResponseCVE-2026-44473Fix available7.1 High
- opnsense coreUltraDAG: Smart Account Spending Policy Bypass via PocketsCVE-2026-422788.8 High
- flightphp coreFlight: Sensitive information disclosure via default error handler in flightphp/coreCVE-2026-42552Fix available7.5 High
- flightphp coreFlight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/coreCVE-2026-42551Fix available7.5 High
- flightphp coreFlight: SQL Injection via unvalidated identifiers in SimplePdo::insert / update / deleteCVE-2026-42550Fix available8.8 High
- flightphp coreFlight: Path traversal in `make:controller` CLI creates arbitrary directories outside project rootCVE-2026-42549Fix available4.4 Medium
- flightphp coreFlight: Reflected XSS via unvalidated JSONP callback in Flight::jsonp()CVE-2026-42548Fix available8.6 High
- ultradag, opnsense core +1 moreUltraDAG: SmartOp Vote Path Triggers Fatal Supply Invariant HaltCVE-2026-405838.8 High
- opnsense coreREDAXO before 5.21.0 Reflected XSS via Packages API function ParameterCVE-2026-117538Fix available2.1 Low
- opnsense coreREDAXO before 5.21.0 Reflected XSS via Metainfo API type ParameterCVE-2026-117537Fix available2.1 Low
- opnsense, opnsense core +1 moreOPNsense has an LDAP Injection via Unsanitized Username in AuthenticationCVE-2026-345788.2 High
- ellanetworks core, ella core +1 moreElla Core Has Audit Log Falsification via Path/Body IMSI Mismatch in UpdateSubscriberCVE-2026-34762Fix available2.7 Low
- ellanetworks core, ella core +1 moreElla Core Panics Upon NGAP handover failureCVE-2026-34761Fix available5.8 Medium
- home-assistant core, home-assistant +1 moreHome Assistant has stored XSS in history-graphsCVE-2026-33045Fix available7.3 High
- home-assistant core, home-assistant +1 moreHome Assistant has stored XSS in Map-card through malicious device nameCVE-2026-33044Fix available7.3 High
- ellanetworks core, ella core +1 moreElla Core Panics during NAS Authentication Response/Failure with missing IEsCVE-2026-33907Fix available6.5 Medium
- ellanetworks core, ella core +1 moreElla Core has Privilege Escalation via Database Restore by NetworkManager roleCVE-2026-33906Fix available7.2 High
- ellanetworks core, ella core +1 moreElla Core has a Denial of Service via SCTP connection cleanup deadlockCVE-2026-33904Fix available6.5 Medium
- ellanetworks core, ella core +1 moreElla Core panics when processing a crafted NGAP LocationReport messageCVE-2026-33903Fix available6.5 Medium
- accellion kiteworks, kiteworks core +1 moreKiteworks Core before 9.2.2 is vulnerable to Improper Ownership ManagementCVE-2026-235148.8 High
- ellanetworks core, ella core +1 moreElla Core panics on malformed ULNASTransport Message without a Request TypeCVE-2026-33283Fix available6.5 Medium
- ellanetworks core, ella core +1 moreElla Core panics on malformed NGAP Location ReportCVE-2026-33282Fix available7.5 High
- ellanetworks core, ella core +1 moreElla Core panics on invalid PDU Session IDs in NGAP messagesCVE-2026-33281Fix available6.5 Medium
- @angular compiler, core, angular cli +2 moreAngular has XSS in i18n attribute bindingsCVE-2026-32635Public exploitFix available8.6 High
- ellanetworks core, ella core +1 moreElla Core: AMF DoS via malformed PathSwitchRequest with empty NR security capability bitstringsCVE-2026-32320Fix available6.5 Medium
- ellanetworks core, ella core +1 moreElla Core: Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payloadCVE-2026-32319Fix available7.5 High
- runzero platform, shopware, opnsense core +2 moreShopware has a potential take over of app credentialsCVE-2026-31889Fix available8.9 High
- runzero platform, shopware, opnsense core +2 moreShopware has user enumeration via distinct error codes on Store API login endpointCVE-2026-31888Fix available5.3 Medium
- runzero platform, shopware, opnsense core +2 moreShopware unauthenticated data extraction possible through store-api.order endpointCVE-2026-31887Fix available8.9 High
- opnsense core, opnsense +1 moreCross-Site Request Forgery (CSRF) in opnsense/coreCVE-2026-308686.3 Medium
- opnsense core, typicms +1 moreTypiCMS Core has Stored Cross-Site Scripting (XSS) via SVG File UploadCVE-2026-27621Public exploitFix available6.8 Medium
- deciso opnsenseOPNsense 19.1 Reflected XSS via system_advanced_sysctl.phpCVE-2019-253774.8 Medium
- deciso opnsenseOPNsense 19.1 Reflected XSS via proxy endpointCVE-2019-253765.1 Medium
- deciso opnsenseOPNsense 19.1 Reflected XSS via monit interfaceCVE-2019-253755.1 Medium
- deciso opnsenseOPNsense 19.1 Reflected XSS via vpn_ipsec_settings.phpCVE-2019-253745.1 Medium
- deciso opnsenseOPNsense 19.1 Stored XSS via firewall_rules_edit.phpCVE-2019-253735.1 Medium
- deciso opnsenseOPNsense 19.1 Reflected XSS via diag_traceroute.phpCVE-2019-253725.1 Medium
- deciso opnsenseOPNsense 19.1 Reflected XSS via diag_ping.phpCVE-2019-253715.1 Medium
- deciso opnsenseOPNsense 19.1 Reflected XSS via interfaces_vlan_edit.phpCVE-2019-253705.1 Medium
- deciso opnsenseOPNsense 19.1 Stored XSS via system_advanced_sysctl.phpCVE-2019-253695.1 Medium
- deciso opnsenseOPNsense 19.1 Reflected XSS via diag_backup.phpCVE-2019-253684.8 Medium
- emmett-framework coreEmmett has an Unhandled CookieError Exception Causing Denial of ServiceCVE-2026-25577Fix available7.5 High
- adonisjs bodyparser, core +1 moreAdonisJS vulnerable to Denial of Service (DoS) via Unrestricted Memory Buffering in PartHandler during File Type DetectionCVE-2026-25762Fix available7.5 High
- adonisjs bodyparser, core +1 moreAdonisJS multipart body parsing has Prototype Pollution issueCVE-2026-25754Fix available7.2 High
- adonisjs coreAdonisJS Path Traversal in Multipart File HandlingCVE-2026-21440Public exploitFix available9.2 Critical
- alloy-rs coreAlloy Core has a DoS vulnerability on `alloy_dyn_abi::TypedData` hashingCVE-2025-62370Fix available7.5 High
- freepbx core, sangoma freepbx +1 moreFreePBX core module vulnerable to reflected cross-site scripting via Asterisk HTTP Status pageCVE-2025-594298.5 High
- Show moreLoading…