Login Request a demo
LU
Product
luci
by openwrt · last CVE Sep 21, 2026
20
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities20In the news0Timeline
Severity mix
Critical 3High 10Medium 7Low 0
Severity
All severities20Critical3High10Medium7Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add luci to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-55897
8.8
1%
Sep 21
luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root
Affected: < 1.1.2-6
CVE-2026-72840
8.8
0%
Aug 13
OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write
Affected: through 24.10.8; 25.12.0 through 25.12.5
CVE-2026-69096
8.8
3%
Aug 3
OpenWrt luci-app-dockerman Read ACL Remote Code Execution
Affected: 26.162.29621~507ab5e
CVE-2026-61876
8.8
2%
Jul 12
LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting
Affected: All versions, or not specified
CVE-2026-61875
8.8
0%
Jul 12
luci-app-upnp Stored XSS via UPnP Port Mapping Description
Affected: before 24.10.8; 25.12.0 before 25.12.5
CVE-2026-59260
8.8
1%
Jul 12
OpenWrt luci-app-samba4 read ACL remote code execution via smbd
Affected: before 24.10.8; 25.12.0 before 25.12.5
CVE-2024-20104
8.4
0%
Nov 4
In da, there is a possible out of bounds write due to a missing bounds check
Affected: 19.07.0; 21.02; 23.05
CVE-2024-51240
8.0
0%
Nov 5
An issue in the luci-mod-rpc package in OpenWRT Luci LTS allows for privilege escalation from an admin account to root via the JSON-RPC-API, which is exposed by the luci-mod-rpc…
Affected: 0
CVE-2026-67352
7.6
0%
Aug 1
luci-app-https-dns-proxy Stored XSS via resolver_url
Affected: 0
CVE-2026-69095
7.5
1%
Aug 3
OpenWrt luci-app-bmx7 Path Traversal via bmx7-info
Affected: before 5890760a454dad2cb00389dba2cdc5e779e0ffdd
Showing 10