Luci

This hub aggregates every CVE we track for Luci, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Luci.

• CVE-2026-69096OpenWrt luci-app-dockerman Read ACL Remote Code Execution8.8Aug 3, 2026
• CVE-2026-69095OpenWrt luci-app-bmx7 Path Traversal via bmx7-info7.5Aug 3, 2026
• CVE-2026-68583luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name5.4Aug 2, 2026
• CVE-2026-67352luci-app-https-dns-proxy Stored XSS via resolver_url7.6Aug 1, 2026
• CVE-2026-61876LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting8.8Jul 12, 2026
• CVE-2026-61875luci-app-upnp Stored XSS via UPnP Port Mapping Description8.8Jul 12, 2026
• CVE-2026-59260OpenWrt luci-app-samba4 read ACL remote code execution via smbd8.8Jul 12, 2026
• CVE-2026-32721LuCI luci-mod-network: Possible XSS attack in WiFi scan on Joining Wireless Client modal8.6Mar 19, 2026
• CVE-2024-51240An issue in the luci-mod-rpc package in OpenWRT Luci LTS allows for privilege escalation from an admin account to root via the JSON-RPC-API, which is exposed by the luci-mod-rpc package8.0Nov 5, 2024
• CVE-2023-3085X-WRT luci 404 Error Template dispatcher.uc run_action cross site scripting3.5Jun 3, 2023
• CVE-2023-24181LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /openvpn/pageswitch.htm.5.4Apr 10, 2023
• CVE-2022-41435OpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /system/sshkeys.js. This vulnerability allows attackers to...5.4Nov 3, 2022
• CVE-2021-27821The Web Interface for OpenWRT LuCI version 19.07 and lower has been discovered to have a cross-site scripting vulnerability.6.1May 25, 2021
• CVE-2020-10871In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and services. NOTE: the vendor disputes the significance of this report because, for instances...5.3Mar 23, 2020
• CVE-2019-12272In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_status of the web application are affected by a command injection vulnerability.9.8May 23, 2019