https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-32721.htmlhttps://patchthecve.com/cve/CVE-2026-32721.htmlWed, 17 Jun 2026 10:36:16 +0000HIGH 8.6: LuCI is the OpenWrt Configuration Interface. Versions prior to both 24.10.5 and 25.12.0, contain a stored XSS vulnerability in the wireless scan modal, where SSID values from scan results are rendered as raw HTML without any sanitization. The wireless.js file in the luci-mod-network package passes Shttps://patchthecve.com/cve/CVE-2023-3085.htmlhttps://patchthecve.com/cve/CVE-2023-3085.htmlWed, 17 Jun 2026 06:13:19 +0000LOW 3.5: A vulnerability, which was classified as problematic, has been found in X-WRT luci up to 22.10_b202303061504. This issue affects the function run_action of the file modules/luci-base/ucode/dispatcher.uc of the component 404 Error Template Handler. The manipulation of the argument request_path leads https://patchthecve.com/cve/CVE-2023-24181.htmlhttps://patchthecve.com/cve/CVE-2023-24181.htmlWed, 17 Jun 2026 05:38:49 +0000MEDIUM 5.4: LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /openvpn/pageswitch.htm.https://patchthecve.com/cve/CVE-2022-41435.htmlhttps://patchthecve.com/cve/CVE-2022-41435.htmlWed, 17 Jun 2026 05:03:12 +0000MEDIUM 5.4: OpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /system/sshkeys.js. This vulnerability allows attackers to execute arbitrary web scripts or HTML via crafted public key comments.https://patchthecve.com/cve/CVE-2021-27821.htmlhttps://patchthecve.com/cve/CVE-2021-27821.htmlThu, 09 Jul 2026 01:16:49 +0000MEDIUM 6.1: The Web Interface for OpenWRT LuCI version 19.07 and lower has been discovered to have a cross-site scripting vulnerability.https://patchthecve.com/cve/CVE-2020-10871.htmlhttps://patchthecve.com/cve/CVE-2020-10871.htmlWed, 17 Jun 2026 02:48:35 +0000MEDIUM 5.3: In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and services. NOTE: the vendor disputes the significance of this report because, for instances reachable by an unauthenticated actor, the same information is available in other (more complex) ways,https://patchthecve.com/cve/CVE-2019-12272.htmlhttps://patchthecve.com/cve/CVE-2019-12272.htmlWed, 17 Jun 2026 02:14:21 +0000CRITICAL 9.8: In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_status of the web application are affected by a command injection vulnerability.https://patchthecve.com/cve/CVE-2014-3593.htmlhttps://patchthecve.com/cve/CVE-2014-3593.htmlWed, 17 Jun 2026 00:08:35 +0000MEDIUM 6.0: Eval injection vulnerability in luci 0.26.0 allows remote authenticated users with certain permissions to execute arbitrary Python code via a crafted cluster configuration.https://patchthecve.com/cve/CVE-2013-4482.htmlhttps://patchthecve.com/cve/CVE-2013-4482.htmlTue, 16 Jun 2026 23:57:18 +0000MEDIUM 6.2: Untrusted search path vulnerability in python-paste-script (aka paster) in Luci 0.26.0, when started using the initscript, allows local users to gain privileges via a Trojan horse .egg-info file in the (1) current working directory or (2) its parent directories.https://patchthecve.com/cve/CVE-2013-4481.htmlhttps://patchthecve.com/cve/CVE-2013-4481.htmlTue, 16 Jun 2026 23:57:18 +0000LOW 1.9: Race condition in Luci 0.26.0 creates /var/lib/luci/etc/luci.ini with world-readable permissions before restricting the permissions, which allows local users to read the file and obtain sensitive information such as "authentication secrets."