How many CVEs have a located fix in openwrt/luci?

15 published CVEs have a fix traced to functions in openwrt/luci, touching 31 functions across 17 files.

Which function in openwrt/luci has been patched by the most CVEs?

syncCron in applications/luci-app-adblock-fast/htdocs/luci-static/resources/adblock-fast/status.js has been changed by 1 CVE fixes, from 2026 to 2026.

How large is a typical CVE fix in openwrt/luci?

The median fix changes 5 lines. 80% of fixes change 20 lines or fewer, and 40% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

javascript

lua

#381 of 500 repositories

openwrt/luci

Name: openwrt/luci: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix September 21, 2026

15

CVE fixes located

Published CVEs

31

Functions patched

Distinct function sites

17

Files patched

Distinct source files

2019–2026

Years covered

By CVE publication date

Overview

15 published CVEs have a fix traced to functions in openwrt/luci, the earliest published in 2019. Those fixes changed 31 distinct functions across 17 files, in 327 patch hunks.

Among the 500 repositories tracked here, openwrt/luci ranks #381 by the number of CVEs with a located fix.

Most patched functions

Functions in openwrt/luci changed by the most CVE fixes.

Most patched files

Files in openwrt/luci changed by the most CVE fixes.

1modules/luci-mod-system/htdocs/luci-static/resources/view/system/sshkeys.js2 CVEs · 2 functions
2applications/luci-app-firewall/luasrc/model/cbi/firewall/rule-details.lua2 CVEs · 0 functions
3modules/luci-mod-network/htdocs/luci-static/resources/view/network/wireless.js1 CVEs · 14 functions
4applications/luci-app-ddns/luasrc/model/cbi/ddns/detail.lua1 CVEs · 4 functions
5applications/luci-app-adblock-fast/htdocs/luci-static/resources/adblock-fast/status.js1 CVEs · 3 functions
6modules/luci-base/luasrc/dispatcher.lua1 CVEs · 2 functions
7modules/luci-mod-admin-full/luasrc/controller/admin/status.lua1 CVEs · 2 functions
8applications/luci-app-adblock-fast/htdocs/luci-static/resources/view/adblock-fast/overview.js1 CVEs · 1 functions
9applications/luci-app-privoxy/htdocs/luci-static/resources/view/privoxy/privoxy.js1 CVEs · 1 functions
10modules/luci-mod-network/htdocs/luci-static/resources/view/network/dhcp.js1 CVEs · 1 functions

Fix size

How much code a CVE fix in openwrt/luci changes, with backports counted once.

5

Median lines changed

Added plus removed, per CVE

80%

Fixes of 20 lines or fewer

Share of CVE fixes

40%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in openwrt/luci, and the functions each fix changed.

luci-app-adblock-fast: Delegated `luci-app-adblock-fast` users can reach root command execution by injecting newline-separated cron entries
CVE-2026-55159then syncCron ChromeExtensionId
High · CVSS 8.8
EPSS 0.5%2026-09-21
OpenWrt luci-app-dockerman Read ACL Remote Code Execution
CVE-2026-69096updateCertPath
High · CVSS 8.7
EPSS 3.3%2026-08-03
OpenWrt odhcpd/LuCI: unauthenticated DHCPv6 client can inject lease-file lines via FQDN hostname → stored XSS in the LuCI admin UI
CVE-2026-62948join
Critical · CVSS 9.6
EPSS 0.6%2026-07-15
luci-app-banip Log Monitor IP Extraction Bypass
CVE-2026-62184
High · CVSS 8.7
EPSS 0.8%2026-07-13
luci-app-travelmate - Arbitrary Command Execution via UCI Script Parameter
CVE-2026-58652
High · CVSS 7.7
EPSS 0.8%2026-07-02
LuCI luci-mod-network: Possible XSS attack in WiFi scan on Joining Wireless Client modal
CVE-2026-32721format_wifirate render_signal_badge render_network_status
High · CVSS 8.6
EPSS 0.3%2026-03-19
CVE-2023-24182
CVE-2023-24182removeKey
Medium · CVSS 5.4
EPSS 0.6%2023-04-11
CVE-2023-24181
CVE-2023-24181
Medium · CVSS 5.4
EPSS 0.6%2023-04-10
CVE-2022-41435
CVE-2022-41435renderKeyItem
Medium · CVSS 5.4
EPSS 0.5%2022-11-03
CVE-2021-28961
CVE-2021-28961_verify_ip_source iurl4 iurl6
High · CVSS 8.8
EPSS 1.7%2021-03-21
CVE-2019-25015
CVE-2019-25015
Medium · CVSS 5.4
EPSS 0.6%2021-01-21
CVE-2019-18992
CVE-2019-18992
Medium · CVSS 5.4
EPSS 0.5%2019-12-03

Get an alert for each new openwrt/luci CVE, with the patched functions and AI-written analysis.

Monitor luci CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

0xJacky/nginx-ui15 CVEs apache/mynewt-nimble15 CVEs cubecart/v615 CVEs debian/busybox15 CVEs debian/libsoup315 CVEs debian/zziplib15 CVEs decolua/9router15 CVEs DSpace/DSpace15 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in openwrt/luci.

How many CVEs have a located fix in openwrt/luci?: 15 published CVEs have a fix traced to functions in openwrt/luci, touching 31 functions across 17 files.
Which function in openwrt/luci has been patched by the most CVEs?: syncCron in applications/luci-app-adblock-fast/htdocs/luci-static/resources/adblock-fast/status.js has been changed by 1 CVE fixes, from 2026 to 2026.
How large is a typical CVE fix in openwrt/luci?: The median fix changes 5 lines. 80% of fixes change 20 lines or fewer, and 40% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track openwrt/luci CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing