- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/21/2026, core recorded 11 security vulnerabilities in the last 90 days, of which 6 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of core and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-71490OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protectionCVE-2026-63442OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP BlockingCVE-2026-58390OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status viewsCVE-2026-58394OPNsense: Stored XSS in Administration Settings via Certificate DescriptionCVE-2026-58392OPNsense: Stored XSS in Services: NTP GPS| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-71490OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection | Exploitation statusActively exploited | FixYes |
| SeverityHigh |
CVE-2026-63442OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking | Exploitation statusNot exploited | FixYes | Published10/15/2026 | SeverityHigh |
|---|
CVE-2026-58390OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views | Exploitation statusActively exploited | FixYes | Published10/15/2026 | SeverityHigh |
|---|
CVE-2026-58394OPNsense: Stored XSS in Administration Settings via Certificate Description | Exploitation statusActively exploited | FixYes | Published10/15/2026 | SeverityMedium |
|---|
CVE-2026-58392OPNsense: Stored XSS in Services: NTP GPS | Exploitation statusActively exploited | FixYes | Published10/15/2026 | SeverityMedium |
|---|
CVE-2026-58395OPNsense: XPath injection in MVC safe-delete | Exploitation statusActively exploited | FixYes | Published10/15/2026 | SeverityMedium |
|---|
CVE-2026-58393OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated CSO files | Exploitation statusActively exploited | FixYes | Published10/15/2026 | SeverityMedium |
|---|
CVE-2026-57155OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer | Exploitation statusActively exploited | FixYes | Published10/15/2026 | SeverityCritical |
|---|
CVE-2026-58391OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout | Exploitation statusActively exploited | FixYes | Published10/15/2026 | SeverityMedium |
|---|
CVE-2026-53582OPNsense: XPATH Injection can disclose any secret in config.xml | Exploitation statusNot exploited | FixYes | Published10/15/2026 | SeverityHigh |
|---|
17 Results | Page 1 of 2