CVE-2026-68583 luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name

luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the administrator's browser...

CVE-2026-68583 luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name

luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the administrator's browser...

PT-2026-67325

luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver url parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the...