https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T23:51:16.641888+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-379552 EUVD-2026-379552 2026-10-05T23:51:16.698208+00:00 EUVD-2026-379552 https://cve.radiocsirt.org/vuln/fkie_cve-2026-61875 fkie_cve-2026-61875 2026-10-05T23:51:16.698252+00:00

luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOAP requests. Attackers can send malicious HTML in the NewPortMappingDescription field, which miniupnpd stores and luci-app-upnp renders without output encoding, executing the payload when administrators view the UPnP or Status pages.

 https://cve.radiocsirt.org/vuln/ghsa-xwgp-pprm-vcx3 GHSA-xwgp-pprm-vcx3 2026-10-05T23:51:16.698289+00:00

luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOAP requests. Attackers can send malicious HTML in the NewPortMappingDescription field, which miniupnpd stores and luci-app-upnp renders without output encoding, executing the payload when administrators view the UPnP or Status pages.