O
Vendor security profile
openwrt
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs33
Critical3
CISA KEV0
Public exploit13
Patch rate%18
Avg. CVSS7.8
12-month vulnerability rate
0
0
0
0
0
0
0
0
6
8
2
1
CVE KEV
CVE severity distribution
33toplam CVE
Critical3 (9%)
High20 (61%)
Medium10 (30%)
Patch and exploitation view
%18
Verified patch
%0
CISA KEV
%39
Public exploit
6Patch available
0Partial
0Workaround
0Vendor: no patch
27Unknown
Latest vulnerabilities
6.5
CVE-2026-53922
odhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (stack BOF, canary-terminated)
O
Patch status unknown
8.8
CVE-2026-55897
luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root
O
Patch status unknownEPSS %1
8.8
CVE-2026-55159
luci-app-adblock-fast: Delegated `luci-app-adblock-fast` users can reach root command execution by injecting newline-separated cron entries
O
Patch status unknownEPSS %0
6.9
CVE-2026-62381
luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflow
O
Patch status unknownEPSS %0
9.4
CVE-2026-72842
OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass
O
Patch status unknownEPSS %1
9.4
CVE-2026-72841
luci-app-openvpn Path Traversal RCE via instance_name2
O
Patch status unknownEPSS %1
8.7
CVE-2026-72840
OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write
O
Patch status unknownEPSS %0
8.7
CVE-2026-69096
OpenWrt luci-app-dockerman Read ACL Remote Code Execution
O
Patch verifiedEPSS %3
8.7
CVE-2026-69095
OpenWrt luci-app-bmx7 Path Traversal via bmx7-info
O
Patch status unknownEPSS %1
5.1
CVE-2026-68583
luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name
O
Patch status unknownEPSS %0