Login Request a demo
LU
Product
luci
by openwrt · last CVE Sep 21, 2026
18
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities18In the news0Timeline
Severity mix
Critical 3High 8Medium 7Low 0
Severity
All severities18Critical3High8Medium7Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add luci to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-72842
9.9
1%
Aug 13
OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass
Affected: through 24.10.8; 25.12.0 through 25.12.5
CVE-2026-72841
9.9
1%
Aug 13
luci-app-openvpn Path Traversal RCE via instance_name2
Affected: before 24.10.7; 25.12.0 before 25.12.4
CVE-2019-12272
9.8
7%
May 23
In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_status of the web application are affected by a command…
Affected: through 0.10.0
CVE-2026-55897
8.8
1%
Sep 21
luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root
Affected: < 1.1.2-6
CVE-2026-72840
8.8
0%
Aug 13
OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write
Affected: through 24.10.8; 25.12.0 through 25.12.5
CVE-2026-69096
8.8
3%
Aug 3
OpenWrt luci-app-dockerman Read ACL Remote Code Execution
Affected: 26.162.29621~507ab5e
CVE-2026-61876
8.8
2%
Jul 12
LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting
Affected: All versions, or not specified
CVE-2026-61875
8.8
0%
Jul 12
luci-app-upnp Stored XSS via UPnP Port Mapping Description
Affected: before 24.10.8; 25.12.0 before 25.12.5
CVE-2026-59260
8.8
1%
Jul 12
OpenWrt luci-app-samba4 read ACL remote code execution via smbd
Affected: before 24.10.8; 25.12.0 before 25.12.5
CVE-2026-67352
7.6
0%
Aug 1
luci-app-https-dns-proxy Stored XSS via resolver_url
Affected: 0
CVE-2026-69095
7.5
1%
Aug 3
OpenWrt luci-app-bmx7 Path Traversal via bmx7-info
Affected: before 5890760a454dad2cb00389dba2cdc5e779e0ffdd
CVE-2026-62381
6.6
0%
Aug 22
luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflow
Affected: through 42d72f79cd8f057f241595abc761b39dab2d9f07
CVE-2021-27821
6.1
1%
May 25
The Web Interface for OpenWRT LuCI version 19.07 and lower has been discovered to have a cross-site scripting vulnerability
Affected: through 19.07.0
CVE-2026-68583
5.4
0%
Aug 2
luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name
Affected: before 1.2.4-4
CVE-2023-24181
5.4
1%
Apr 10
LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /openvpn/pageswitch.htm
Affected: 22.03.3
CVE-2022-41435
5.4
1%
Nov 3
OpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /system/sshkeys.js
Affected: git-22.140.66206-02913be
CVE-2020-10871
5.3
2%
Mar 23
In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and services
Affected: git-20.049.11521-bebfe20; git-20.078.22902-0ed0d42
CVE-2026-32721
4.8
0%
Mar 19
LuCI luci-mod-network: Possible XSS attack in WiFi scan on Joining Wireless Client modal
Affected: < 26.072.65753~068150b
Showing 18