pfSense and OPNsense vulnerabilities and fixes

CVEs that mention pfSense and OPNsense, ranked by priority. 3 tracked.

pfSense and OPNsense has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2026-10-21. Highest priority: CVE-2026-113779 (score 39/100).

• CVE-2026-113779 HIGH 8.8 The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plu
• CVE-2026-49131 MEDIUM 5.4 OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attacker
• CVE-2026-49132 MEDIUM 5.4 OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attacker

FAQ

How do I fix pfSense and OPNsense vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is pfSense and OPNsense being exploited right now?

None of the tracked pfSense and OPNsense CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which pfSense and OPNsense CVE should I patch first?

CVE-2026-113779 currently ranks highest (39/100): The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plu.

← Back to latest CVEs