# cve.now: Openwrt

The newest entries naming Openwrt as an affected vendor (up to 200), of 38 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-55614](https://cve.now/CVE-2026-55614.md): uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matching (CVSS 6.9)
- [CVE-2026-55612](https://cve.now/CVE-2026-55612.md): uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state reset (CVSS 3.7)
- [CVE-2026-55613](https://cve.now/CVE-2026-55613.md): uhttpd: HTTP request smuggling via ubus POST body parse-error desync (CVSS 6.9)
- [CVE-2026-55606](https://cve.now/CVE-2026-55606.md): odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp() (CVSS 6.5)
- [CVE-2026-53918](https://cve.now/CVE-2026-53918.md): odhcpd DHCPv6 IA dangling first pointer use-after-free (CVSS 8.8)
- [CVE-2026-53920](https://cve.now/CVE-2026-53920.md): odhcpd DHCPv6 Short IA\_NA/IA\_PD Body Stack Disclosure (CVSS 8.7)
- [CVE-2026-53921](https://cve.now/CVE-2026-53921.md): odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites) (CVSS 9.8)
- [CVE-2026-53922](https://cve.now/CVE-2026-53922.md): odhcpd: pre-auth remote DoS via size\_t underflow in dhcpv6\_ia\_handle\_IAs (stack BOF, canary-terminated) (CVSS 6.5)
- [CVE-2026-55897](https://cve.now/CVE-2026-55897.md): luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root (CVSS 8.8)
- [CVE-2026-55159](https://cve.now/CVE-2026-55159.md): luci-app-adblock-fast: Delegated \`luci-app-adblock-fast\` users can reach root command execution by injecting newline-separated cron entries (CVSS 8.8)
- [CVE-2026-62381](https://cve.now/CVE-2026-62381.md): luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflow (CVSS 6.9)
- [CVE-2026-72842](https://cve.now/CVE-2026-72842.md): OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass (CVSS 9.4)
- [CVE-2026-72841](https://cve.now/CVE-2026-72841.md): luci-app-openvpn Path Traversal RCE via instance\_name2 (CVSS 9.4)
- [CVE-2026-72840](https://cve.now/CVE-2026-72840.md): OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write (CVSS 8.7)
- [CVE-2026-69096](https://cve.now/CVE-2026-69096.md): OpenWrt luci-app-dockerman Read ACL Remote Code Execution (CVSS 8.7)
- [CVE-2026-69095](https://cve.now/CVE-2026-69095.md): OpenWrt luci-app-bmx7 Path Traversal via bmx7-info (CVSS 8.7)
- [CVE-2026-68583](https://cve.now/CVE-2026-68583.md): luci-app-adblock-fast before 1.2.4-4 Stored XSS via file\_url.name (CVSS 5.1)
- [CVE-2026-67352](https://cve.now/CVE-2026-67352.md): luci-app-https-dns-proxy Stored XSS via resolver\_url (CVSS 6.8)
- [CVE-2026-62947](https://cve.now/CVE-2026-62947.md): OpenWrt: ACL bypass and arbitrary root file read via cgi-io cgi-download (CVSS 4.9)
- [CVE-2026-62948](https://cve.now/CVE-2026-62948.md): OpenWrt odhcpd/LuCI: unauthenticated DHCPv6 client can inject lease-file lines via FQDN hostname → stored XSS in the LuCI admin UI (CVSS 9.6)
- [CVE-2026-62184](https://cve.now/CVE-2026-62184.md): luci-app-banip Log Monitor IP Extraction Bypass (CVSS 8.7)
- [CVE-2026-61876](https://cve.now/CVE-2026-61876.md): LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting (CVSS 9.4)
- [CVE-2026-61875](https://cve.now/CVE-2026-61875.md): luci-app-upnp Stored XSS via UPnP Port Mapping Description (CVSS 8.7)
- [CVE-2026-59260](https://cve.now/CVE-2026-59260.md): OpenWrt luci-app-samba4 read ACL remote code execution via smbd (CVSS 8.7)
- [CVE-2026-55490](https://cve.now/CVE-2026-55490.md): OpenWrt: EAD Integer Underflow → Pre-Auth Denial of Service (CVSS 6.5)
- [CVE-2026-58652](https://cve.now/CVE-2026-58652.md): luci-app-travelmate - Arbitrary Command Execution via UCI Script Parameter (CVSS 7.7)
- [CVE-2026-58000](https://cve.now/CVE-2026-58000.md): luci-proto-openvpn - Command Injection via cl\_meta Parameter in generateKey (CVSS 8.7)
- [CVE-2026-57999](https://cve.now/CVE-2026-57999.md): luci-app-tailscale-community - Command Injection via tailscale.do\_login RPC (CVSS 7.7)
- [CVE-2026-32721](https://cve.now/CVE-2026-32721.md): LuCI luci-mod-network: Possible XSS attack in WiFi scan on Joining Wireless Client modal (CVSS 8.6)
- [CVE-2026-30874](https://cve.now/CVE-2026-30874.md): OpenWrt procd PATH Environment Variable Filter Bypass via Incorrect String Comparison Leads to Privilege Escalation (CVSS 1.8)
- [CVE-2026-30873](https://cve.now/CVE-2026-30873.md): OpenWrt Project jsonpath: Memory leak when processing strings, labels, and regexp tokens (CVSS 2.4)
- [CVE-2026-30872](https://cve.now/CVE-2026-30872.md): OpenWrt Project has a Stack-based Buffer Overflow vulnerability via IPv6 reverse DNS lookup (CVSS 9.5)
- [CVE-2026-30871](https://cve.now/CVE-2026-30871.md): OpenWrt Project has Stack-based Buffer Overflow in DNS PTR Query (CVSS 9.5)
- [CVE-2025-62526](https://cve.now/CVE-2025-62526.md): OpenWrt ubusd vulnerable to heap buffer overflow (CVSS 7.9)
- [CVE-2025-62525](https://cve.now/CVE-2025-62525.md): OpenWrt vulnerable to local privilage escalation (CVSS 7.9)
- [CVE-2024-54143](https://cve.now/CVE-2024-54143.md): openwrt/asu allows build artifact poisoning via truncated SHA-256 hash and command injection (CVSS 9.3)
- [CVE-2019-5102](https://cve.now/CVE-2019-5102.md): An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. (CVSS 4.0)
- [CVE-2019-5101](https://cve.now/CVE-2019-5101.md): An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. (CVSS 4.0)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/openwrt
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.