https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-20T01:19:27.955046+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-53582 fkie_cve-2026-53582 2026-10-20T01:19:27.967360+00:00

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php. A user with CA Manager or Certificate Manager privileges can submit a crafted refid and repeatedly retrieve the object to obtain a boolean refcount oracle, allowing values in config.xml to be recovered character by character. Exposed values can include password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, enabling privilege escalation and compromise of other security domains. This issue is fixed in version 26.1.10.

 https://db.gcve.eu/vuln/wid-sec-w-2026-1917 WID-SEC-W-2026-1917 — OPNsense: Schwachstelle ermöglicht Offenlegung von Informationen 2026-10-20T01:19:27.967427+00:00

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in OPNsense ausnutzen, um Informationen offenzulegen.