Threats affecting pkg:github/core

CVE-2026-119560 is a configuration injection vulnerability in OPNsense core up to version 26.7.8. Authenticated users with specific privileges can inject newline characters into ntpd.conf directives via the fudge and refid fields, potentially altering ntpd configuration loaded by the root user.

OPNsense core versions 26.1.6 through 26.7.7 have an authentication bypass vulnerability in the captive portal roaming feature. This flaw allows unauthenticated attackers on the same Layer-2 network segment to hijack authorized client sessions by spoofing MAC-to-IP bindings via forged gratuitous ARP replies. Exploitation results in portal access with traffic attributed to the victim.

OPNsense core versions before 26.7.8 have a configuration line injection vulnerability that allows authenticated users with wireless-edit privileges to inject arbitrary directives by embedding CR/LF characters in WPA-related fields. This vulnerability enables attackers to append unauthorized wpa_supplicant or hostapd directives, potentially impacting the wireless configuration.

OPNsense core versions before 26.7.8 have a log injection vulnerability that allows unauthenticated attackers to submit crafted WebGUI login usernames containing victim IP addresses. This can cause the victim IP to be added to the sshlockout table, blocking SSH and WebGUI access and terminating pf states. The vulnerability is fixed in version 26.7.8.

Cheshire Cat AI core versions up to 2.0.23 have a stored cross-site scripting (XSS) vulnerability in the uploads plugin. Authenticated users can upload HTML files without type restrictions via POST /uploads. This allows attackers to craft URLs that execute scripts in the application origin when visited by signed-in users, potentially exposing their access_token cookies, including those of administrators.

Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.