Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 698

Export CSV
CVE-2026-108971

D-Link DCS-930L Emergency HTTP Recovery Server bootloader_region.bin mpfd_decode signature verification

A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improper verification of cryptographic signature. The attack may be performed from remote. The exploit has been published and may be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
D-link
Products
Dcs-930l
CVE-2025-14225

D-Link DCS-930L alphapd setSystemAdmin command injection

A vulnerability was determined in D-Link DCS-930L 1.15.04. This affects an unknown part of the file /setSystemAdmin of the component alphapd. Executing manipulation of the argument AdminID can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 5.3 Medium EPSS 8.9% KEV · Not listed
Vendors
D-link Dlink
Products
Dcs-930l Dcs-930l Dcs-930l Firmware
CVE-2026-95675

D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management Interface

D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted requests to the device's web management interface without valid credentials. Attackers can fully compromise the device to persistently modify its configuration and use it as a pivot point into the local network.

CVSS 4.0 · 9.3 Critical EPSS 2.1% KEV · Not listed
Vendors
D-link Dlink
Products
Dap-1360 Dap-1360 Firmware
CVE-2023-53974

D-Link DSL-124 ME_1.00 Backup Configuration File Disclosure via Unauthenticated Request

D-Link DSL-124 ME_1.00 contains a configuration file disclosure vulnerability that allows unauthenticated attackers to retrieve router settings through a POST request. Attackers can send a specific POST request to the router's configuration endpoint to download a complete backup file containing sensitive network credentials and system configurations.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
D-link Dlink
Products
Dsl-124 Dsl-124 Dsl-124 Firmware
CVE-2026-101081

D-Link DI-8400 Web Administration Service menu_nat_more.asp menu_nat_more_asp stack-based overflow

A security flaw has been discovered in D-Link DI-8400 16.07. This vulnerability affects the function menu_nat_more_asp of the file menu_nat_more.asp of the component Web Administration Service. The manipulation of the argument opt results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
D-link
Products
Di-8400
CVE-2026-100740

D-Link DIR-895L L2TP Control Channel tunnel.c tunnel_set_params out-of-bounds write

A vulnerability was detected in D-Link DIR-895L A1_102b07. Impacted is the function tunnel_set_params of the file tunnel.c of the component L2TP Control Channel Parser. Performing a manipulation results in out-of-bounds write. The attack may be initiated remotely. The exploit is now public and may be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
D-link
Products
Dir-895l
CVE-2026-96891

D-Link DIR-825 rp-l2tp tunnel.c tunnel_set_params out-of-bounds write

A vulnerability was identified in D-Link DIR-825 3.00b32. Affected is the function tunnel_set_params of the file tunnel.c of the component rp-l2tp. The manipulation of the argument peer_hostname  leads to out-of-bounds write. The attack may be initiated remotely.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
D-link
Products
Dir-825
CVE-2026-94050

D-Link DIR-X1860Z ubus JSON-RPC interface routerd.get_rand_key information disclosure

A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfg_get/routerd.get_rand_key of the component ubus JSON-RPC interface. Such manipulation leads to information disclosure. The attack must be carried out from within the local network. Upgrading to version 1.0.7.260821.161908 is able to address this issue. It is suggested to upgrade the affected component. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
D-link
Products
Dir-x1860z
CVE-2026-94089

D-Link DIR-868L Authentication webfa_authentication.cgi strcpy stack-based overflow

A vulnerability was determined in D-Link DIR-868L 2.01b05. This issue affects the function strcpy of the file /webfa_authentication.cgi of the component Authentication Handler. Executing a manipulation of the argument id/password can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
D-link
Products
Dir-868l
CVE-2026-94036

D-Link DIR-X1860/DIR-X1860Z routerd ubus access control

A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. The impacted element is an unknown function of the file /ubus of the component routerd. The manipulation of the argument passwd_set results in improper access controls. The attack must originate from the local network. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
D-link Dlink
Products
Dir-x1860 Dir-x1860z Dir-x1860 and 1 more
CVE-2026-93958

D-Link R95 DHMAPI ssi system os command injection

A vulnerability was found in D-Link R95 BE9500_1.00.16. This vulnerability affects the function system of the file /bin/ssi of the component DHMAPI. The manipulation of the argument NTPServer results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used.

CVSS 4.0 · 9.4 Critical EPSS 2.7% KEV · Not listed
Vendors
D-link Dlink
Products
R95 R95
CVE-2026-90881

D-Link DIR-882 CGI Binary dllog.cgi main information disclosure

A weakness has been identified in D-Link DIR-882 up to 20260814. Impacted is the function main of the file /HNAP1/dllog.cgi of the component CGI Binary. Executing a manipulation can lead to information disclosure. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
D-link
Products
Dir-882
CVE-2026-90705

D-Link DWR-M921 Boa Dispatch Table formsysCmd os command injection

A vulnerability was determined in D-Link DWR-M921 1.1.52. This affects the function formsysCmd of the file /boafrm/formsysCmd of the component Boa Dispatch Table. Executing a manipulation of the argument sysCmd can lead to os command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 5.1 Medium EPSS 2.3% KEV · Not listed
Vendors
D-link
Products
Dwr-m921
CVE-2026-90680

D-Link DIR-823G HNAP1 SetStaticRouteSettings strcpy stack-based overflow

A security flaw has been discovered in D-Link DIR-823G 1.0.2B05_20181207. The impacted element is the function strcpy of the file /HNAP1/SetStaticRouteSettings of the component HNAP1. The manipulation of the argument PAddress/SubnetMask/Gateway results in stack-based buffer overflow. The attack can be launched remotely.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
D-link
Products
Dir-823g
CVE-2026-90880

D-Link DSL-3782 Diagnostics Diagnostics.asp system command injection

A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function system of the file /cgi-bin/New_GUI/Set/Diagnostics.asp of the component Diagnostics. Performing a manipulation of the argument Addr results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 5.3 Medium EPSS 1.9% KEV · Not listed
Vendors
D-link
Products
Dsl-3782
CVE-2026-90703

D-Link DWR-M921 formDiskCreateShare system os command injection

A vulnerability has been found in D-Link DWR-M921 1.1.52. The affected element is the function system of the file /boafrm/formDiskCreateShare. Such manipulation of the argument folderpath leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 9.4 Critical EPSS 3.6% KEV · Not listed
Vendors
D-link
Products
Dwr-m921
CVE-2026-90693

D-Link DIR-878 WAN Settings SetWan3Settings stack-based overflow

A flaw has been found in D-Link DIR-878 120B05. This impacts the function SetWan3Settings of the component WAN Settings. This manipulation of the argument Primary/Secondary causes stack-based buffer overflow. Remote exploitation of the attack is possible.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
D-link
Products
Dir-878
CVE-2026-91003

D-Link DI-8300 CGI Service rzgl.asp rzgl_asp stack-based overflow

A flaw has been found in D-Link DI-8300 16.07. The affected element is the function rzgl_asp of the file /rzgl.asp of the component CGI Service. This manipulation of the argument redirct_url causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
D-link
Products
Di-8300
CVE-2026-91001

D-Link DI-8400 DDNS Configuration ddns.asp ddns_asp stack-based overflow

A security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddns_asp of the file /ddns.asp of the component DDNS Configuration. Performing a manipulation of the argument serv/user/host/wild/mx/bmx/cust/ip results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
D-link
Products
Di-8400
CVE-2026-90692

D-Link DIR-878 Dynamic DNS IPv6 Settings SetDynamicDNSIPv6Settings stack-based overflow

A vulnerability was detected in D-Link DIR-878 120B05. This affects the function SetDynamicDNSIPv6Settings of the component Dynamic DNS IPv6 Settings. The manipulation of the argument IPv6Address/Hostname results in stack-based buffer overflow. The attack may be launched remotely.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
D-link
Products
Dir-878