openwrt

Top products

The 15 most recently published vulnerabilities affecting openwrt.

• CVE-2026-55897luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root8.8Sep 21, 2026
• CVE-2026-55159luci-app-adblock-fast: Delegated `luci-app-adblock-fast` users can reach root command execution by injecting newline-separated cron entries8.8Sep 21, 2026
• CVE-2026-62381luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflow6.6Aug 22, 2026
• CVE-2026-72842OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass9.9Aug 13, 2026
• CVE-2026-72841luci-app-openvpn Path Traversal RCE via instance_name29.9Aug 13, 2026
• CVE-2026-72840OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write8.8Aug 13, 2026
• CVE-2026-69096OpenWrt luci-app-dockerman Read ACL Remote Code Execution8.8Aug 3, 2026
• CVE-2026-69095OpenWrt luci-app-bmx7 Path Traversal via bmx7-info7.5Aug 3, 2026
• CVE-2026-68583luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name5.4Aug 2, 2026
• CVE-2026-67352luci-app-https-dns-proxy Stored XSS via resolver_url7.6Aug 1, 2026
• CVE-2026-62947OpenWrt: ACL bypass and arbitrary root file read via cgi-io cgi-download4.9Jul 15, 2026
• CVE-2026-62948OpenWrt odhcpd/LuCI: unauthenticated DHCPv6 client can inject lease-file lines via FQDN hostname → stored XSS in the LuCI admin UI9.6Jul 15, 2026
• CVE-2026-62184luci-app-banip Log Monitor IP Extraction Bypass7.5Jul 13, 2026
• CVE-2026-61876LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting8.8Jul 12, 2026
• CVE-2026-61875luci-app-upnp Stored XSS via UPnP Port Mapping Description8.8Jul 12, 2026