Openwrt Luci vulnerabilities

• openwrt luci luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root CVE-2026-55897 8.8 HighSeptember 21, 2026
• openwrt luci-app-adblock-fast luci-app-adblock-fast: Delegated `luci-app-adblock-fast` users can reach root command execution by injecting newline-separated cron entries CVE-2026-55159 8.8 HighSeptember 21, 2026
• openwrt luci luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflow CVE-2026-62381 6.9 MediumAugust 22, 2026
• openwrt luci OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass CVE-2026-72842 9.4 CriticalAugust 13, 2026
• openwrt luci luci-app-openvpn Path Traversal RCE via instance_name2 CVE-2026-72841 9.4 CriticalAugust 13, 2026
• openwrt luci OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write CVE-2026-72840 8.7 HighAugust 13, 2026
• openwrt luci OpenWrt luci-app-dockerman Read ACL Remote Code Execution CVE-2026-69096 8.7 HighAugust 3, 2026
• openwrt luci OpenWrt luci-app-bmx7 Path Traversal via bmx7-info CVE-2026-69095 8.7 HighAugust 3, 2026
• openwrt luci luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name CVE-2026-68583 5.1 MediumAugust 2, 2026
• openwrt luci luci-app-https-dns-proxy Stored XSS via resolver_url CVE-2026-67352 6.8 MediumAugust 1, 2026
• openwrt luci-app-banip luci-app-banip Log Monitor IP Extraction Bypass CVE-2026-62184 8.7 HighJuly 13, 2026
• openwrt luci LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting CVE-2026-61876 Public exploit 9.4 CriticalJuly 12, 2026
• openwrt luci luci-app-upnp Stored XSS via UPnP Port Mapping Description CVE-2026-61875 8.7 HighJuly 12, 2026
• openwrt luci OpenWrt luci-app-samba4 read ACL remote code execution via smbd CVE-2026-59260 8.7 HighJuly 12, 2026
• openwrt luci-app-travelmate, travelmate +1 more luci-app-travelmate - Arbitrary Command Execution via UCI Script Parameter CVE-2026-58652 7.7 HighJuly 2, 2026
• openwrt luci-proto-openvpn luci-proto-openvpn - Command Injection via cl_meta Parameter in generateKey CVE-2026-58000 8.7 HighJune 29, 2026
• openwrt luci-app-tailscale-community luci-app-tailscale-community - Command Injection via tailscale.do_login RPC CVE-2026-57999 7.7 HighJune 29, 2026
• openwrt luci, openwrt +1 more LuCI luci-mod-network: Possible XSS attack in WiFi scan on Joining Wireless Client modal CVE-2026-32721 8.6 HighMarch 19, 2026
• openwrt luci An issue in the luci-mod-rpc package in OpenWRT Luci LTS allows for privilege escalation from an... CVE-2024-51240 8.0 HighNovember 5, 2024
• openwrt luci X-WRT luci 404 Error Template dispatcher.uc run_action cross site scripting CVE-2023-3085 3.5 LowJune 3, 2023
• openwrt luci LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /openvpn/pageswitch.htm. CVE-2023-24181 5.4 MediumApril 10, 2023
• openwrt luci OpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site... CVE-2022-41435 5.4 MediumNovember 3, 2022
• openwrt luci The Web Interface for OpenWRT LuCI version 19.07 and lower has been discovered to have a cross... CVE-2021-27821 6.1 MediumMay 25, 2021
• openwrt luci ** DISPUTED ** In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list... CVE-2020-10871 Disputed 5.3 MediumMarch 23, 2020
• openwrt luci In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin... CVE-2019-12272 Public exploit 9.8 CriticalMay 23, 2019