Luci

This hub aggregates every CVE we track for Luci, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Luci.

• CVE-2026-55897luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root8.8Sep 21, 2026
• CVE-2026-62381luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflow6.6Aug 22, 2026
• CVE-2026-72842OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass9.9Aug 13, 2026
• CVE-2026-72841luci-app-openvpn Path Traversal RCE via instance_name29.9Aug 13, 2026
• CVE-2026-72840OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write8.8Aug 13, 2026
• CVE-2026-69096OpenWrt luci-app-dockerman Read ACL Remote Code Execution8.8Aug 3, 2026
• CVE-2026-69095OpenWrt luci-app-bmx7 Path Traversal via bmx7-info7.5Aug 3, 2026
• CVE-2026-68583luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name5.4Aug 2, 2026
• CVE-2026-67352luci-app-https-dns-proxy Stored XSS via resolver_url7.6Aug 1, 2026
• CVE-2026-61876LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting8.8Jul 12, 2026
• CVE-2026-61875luci-app-upnp Stored XSS via UPnP Port Mapping Description8.8Jul 12, 2026
• CVE-2026-59260OpenWrt luci-app-samba4 read ACL remote code execution via smbd8.8Jul 12, 2026
• CVE-2026-32721LuCI luci-mod-network: Possible XSS attack in WiFi scan on Joining Wireless Client modal8.6Mar 19, 2026
• CVE-2024-51240An issue in the luci-mod-rpc package in OpenWRT Luci LTS allows for privilege escalation from an admin account to root via the JSON-RPC-API, which is exposed by the luci-mod-rpc package8.0Nov 5, 2024
• CVE-2023-3085X-WRT luci 404 Error Template dispatcher.uc run_action cross site scripting3.5Jun 3, 2023