Skip to contentOpnsense vulnerabilities
Newest
- accellion kiteworks, kiteworks core +1 moreKiteworks Core Stored Cross-site Scripting (XSS)CVE-2026-1021268.1 High
- accellion kiteworks, kiteworks core +1 moreKiteworks Core Incorrect Privilege AssignmentCVE-2026-1021297.2 High
- accellion kiteworks, kiteworks core +1 moreKiteworks Core Privilege Escalation through Improper Access ControlCVE-2026-1021327.2 High
- accellion kiteworks, kiteworks core +1 moreKiteworks Core Arbitrary File Write through Command InjectionCVE-2026-1021336.6 Medium
- accellion kiteworks, kiteworks core +1 moreKiteworks Core Unprotected Alternate ChannelCVE-2026-1021345.4 Medium
- accellion kiteworks, kiteworks core +1 moreKiteworks Core Command Execution through Configuration InjectionCVE-2026-1021366.3 Medium
- accellion kiteworks, kiteworks core +1 moreKiteworks Core Unrestricted Upload of File with Dangerous TypeCVE-2026-1021374.1 Medium
- accellion kiteworks, kiteworks core +1 moreKiteworks Core Server-Side Request Forgery (SSRF)CVE-2026-1021383.3 Low
- accellion kiteworks, kiteworks core +1 moreKiteworks Core deserialization of untrusted dataCVE-2026-1021018.1 High
- accellion kiteworks, kiteworks core +1 moreKiteworks Core Insufficient Verification of Data AuthenticityCVE-2026-1021404.9 Medium
- accellion kiteworks, kiteworks core +1 moreKiteworks Core Privilege Escalation through External Control of File Name or PathCVE-2026-1021416.7 Medium
- accellion kiteworks, kiteworks core +1 moreKiteworks Core Remote Code Execution through Server-Side Template InjectionCVE-2026-1021427.2 High
- accellion kiteworks, kiteworks core +1 moreKiteworks Core stored XSSCVE-2026-1021008.7 High
- accellion kiteworks, kiteworks core +1 moreKiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)CVE-2026-1021479.3 Critical
- accellion kiteworks, kiteworks core +1 moreKiteworks Core Server-Side Request Forgery through CRLF InjectionCVE-2026-1021456.6 Medium
- accellion kiteworks, kiteworks core +1 moreKiteworks Core OS command injectionCVE-2026-1020967.2 High
- accellion kiteworks, kiteworks core +1 moreKiteworks Core arbitrary file writeCVE-2026-1020997.2 High
- accellion kiteworks, kiteworks core +1 moreKiteworks Core improper privilege managementCVE-2026-1020937.2 High
- accellion kiteworks, kiteworks core +1 moreKiteworks Core stored XSSCVE-2026-1020928.7 High
- accellion kiteworks, kiteworks core +1 moreKiteworks Core content injectionCVE-2026-1020904.3 Medium
- accellion kiteworks, kiteworks core +1 moreKiteworks Core SQL InjectionCVE-2026-1020987.2 High
- redaxo, opnsense core +1 moreREDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon UpdatesCVE-2026-63000Fix available6.4 Medium
- opnsense core, redaxo +1 moreREDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column EnumerationCVE-2026-62998Fix available4.3 Medium
- redaxo, opnsense core +1 moreREDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem FilenamesCVE-2026-63002Fix available4.8 Medium
- redaxo, opnsense core +1 moreREDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`CVE-2026-63001Fix available4.8 Medium
- home-assistant coreHome Assistant: mDNS Server-Side Request ForgeryCVE-2026-91129Fix available5.4 Medium
- home-assistant coreHome Assistant: XSS in Statistics Graph CardCVE-2026-91130Fix available9.3 Critical
- opnsense corentp: write path traversalCVE-2026-535819.0 Critical
- cheshire-cat-ai coreCheshire Cat AI Memory Collection Endpoint Information DisclosureCVE-2026-850937.1 High
- limanmys coreLiman: OS Command Injection in LogRotationController allows authenticated admin to execute arbitrary commands (RCE)CVE-2026-574999.1 Critical
- home-assistant coreHome Assistant: iOS Companion app forwards NFC/QR tag scans without confirmation, enabling silent automation executionCVE-2026-660617.1 High
- home-assistant coreHome Assistant: Unconfirmed NFC/QR tag scans allow silent automation execution by untrusted callersCVE-2026-660607.1 High
- home-assistant coreHome Assistant Companion: `homeassistant://invite` Deep Link Credential PhishingCVE-2026-597174.3 Medium
- bolt coreBolt CMS Server-Side Template Injection via Unsandboxed allow_twig Field RenderingCVE-2026-712918.8 High
- @angular compiler, angular, @angular core +2 moreAngular i18n: Cross-Site Scripting (XSS) via event-handler attributesCVE-2026-69151Fix available7.6 High
- opnsense coreRedaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlersCVE-2026-53599Fix available7.5 High
- @auth core, nextauthjs next-auth +1 moreNextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headersCVE-2026-73418Fix available7.5 High
- @auth core, nextauthjs next-auth +1 moreNextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypassCVE-2026-73420Fix available9.1 Critical
- @auth core, nextauthjs next-auth +1 moreNextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created themCVE-2026-73419Fix available6.8 Medium
- api-platform core, api-platform/hal, api-platform/json-api +2 moreAPI Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gateCVE-2026-49858Fix available5.9 Medium
- api-platform coreAPI Platform Core: Missing IRI type check enables resource type confusionCVE-2026-54164Fix available6.5 Medium
- adonisjs coreIncomplete fix for CVE-2026-25754 in @adonisjs/bodyparserCVE-2026-48795Fix available8.6 High
- home-assistant coreHome Assistant: iOS Companion App ignores internal SSID allowlist for connections – possible leak of access token and sensor dataCVE-2026-558447.5 High
- home-assistant core, home assistant companion +1 moreHome Assistant: Exported BroadcastReceiver allows local apps to spoof device locationCVE-2026-543187.1 High
- home-assistant core, home-assistant +1 moreHome Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LANCVE-2026-54317Fix available7.6 High
- dräger core, m540 converter service +1 moreDräger Core 1.0.5 Denial of Service via Malformed SDC MessageCVE-2024-140368.7 High
- home assistant companion app (android), companion app (ios), home-assistant core +2 moreHome Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injectionCVE-2026-446988.3 High
- opnsense, opnsense core +1 moreOPNsense: Command Injection via Attacker-Controlled DHCP ConfigCVE-2026-451589.1 Critical
- opnsense core, opnsense +1 moreOPNsense: RCE on user managmentCVE-2026-441949.1 Critical
- opnsense, opnsense core +1 moreOPNsense: Authentication lockout bypassCVE-2026-441955.3 Medium
- Show moreLoading…