CVE-2026-58391

OPNsense versions prior to 26.1.11 are vulnerable to a Stored XSS flaw in the Firewall Rules and NAT pages. The root cause is the lack of quote-safe encoding when placing stored category names or alias descriptions into HTML title attributes within filter_rule.volt and nat_rule.volt. Because the ...