Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
22 results
Feb 22, 2026A vulnerability was found in D-Link DWR-M960 1.01.07.CVE-2026-2962 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability was found in D-Link DWR-M960 1.01.07. This vulnerability affects the function sub_460F30 of the file /boafrm/formDateReboot of the component Scheduled Reboot Configuration Endpoint. The manipulation of the argument submit-url results in stack-based buffer overflow. The attack may be performed from remote. The exploit has been made public and could be used.
- Product
- DWR-M960
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2026A vulnerability has been found in D-Link DWR-M960 1.01.07.CVE-2026-2961 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability has been found in D-Link DWR-M960 1.01.07. This affects the function sub_4196C4 of the file /boafrm/formVpnConfigSetup of the component VPN Configuration Endpoint. The manipulation of the argument submit-url leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
- Product
- DWR-M960
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2026A flaw has been found in D-Link DWR-M960 1.01.07.CVE-2026-2960 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A flaw has been found in D-Link DWR-M960 1.01.07. Affected by this issue is the function sub_468D64 of the file /boafrm/formDhcpv6s. Executing a manipulation of the argument submit-url can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used.
- Product
- DWR-M960
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2026A vulnerability was detected in D-Link DWR-M960 1.01.07.CVE-2026-2959 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability was detected in D-Link DWR-M960 1.01.07. Affected by this vulnerability is the function sub_44E0F8 of the file /boafrm/formNewSchedule. Performing a manipulation of the argument url results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used.
- Product
- DWR-M960
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2026A security vulnerability has been detected in D-Link DWR-M960 1.01.07.CVE-2026-2958 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A security vulnerability has been detected in D-Link DWR-M960 1.01.07. Affected is the function sub_457C5C of the file /boafrm/formWsc. Such manipulation of the argument save_apply leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
- Product
- DWR-M960
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2026A vulnerability was determined in D-Link DWR-M960 1.01.07.CVE-2026-2929 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability was determined in D-Link DWR-M960 1.01.07. Impacted is the function sub_453140 of the file /boafrm/formWlAc of the component Wireless Access Control Endpoint. This manipulation of the argument submit-url causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
- Product
- DWR-M960
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2026A vulnerability was found in D-Link DWR-M960 1.01.07.CVE-2026-2928 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability was found in D-Link DWR-M960 1.01.07. This issue affects the function sub_452CCC of the file /boafrm/formWlEncrypt of the component WLAN Encryption Configuration Endpoint. The manipulation of the argument submit-url results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used.
- Product
- DWR-M960
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2026A vulnerability has been found in D-Link DWR-M960 1.01.07.CVE-2026-2927 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability has been found in D-Link DWR-M960 1.01.07. This vulnerability affects the function sub_462590 of the file /boafrm/formOpMode of the component Operation Mode Configuration Endpoint. The manipulation of the argument submit-url leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DWR-M960
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2026A flaw has been found in D-Link DWR-M960 1.01.07.CVE-2026-2926 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A flaw has been found in D-Link DWR-M960 1.01.07. This affects the function sub_4237AC of the file /boafrm/formLteSetup of the component LTE Configuration Endpoint. Executing a manipulation of the argument submit-url can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been published and may be used.
- Product
- DWR-M960
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026A vulnerability was detected in D-Link DWR-M960 1.01.07.CVE-2026-2925 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability was detected in D-Link DWR-M960 1.01.07. Affected by this issue is the function sub_42B5A0 of the file /boafrm/formBridgeVlan of the component Bridge VLAN Configuration Endpoint. Performing a manipulation of the argument submit-url results in stack-based buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.
- Product
- DWR-M960
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026A security flaw has been discovered in D-Link DWR-M960 1.01.07.CVE-2026-2885 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A security flaw has been discovered in D-Link DWR-M960 1.01.07. The impacted element is the function sub_469104 of the file /boafrm/formIpv6Setup. The manipulation of the argument submit-url results in stack-based buffer overflow. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
- Product
- DWR-M960
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026A vulnerability was identified in D-Link DWR-M960 1.01.07.CVE-2026-2884 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability was identified in D-Link DWR-M960 1.01.07. The affected element is the function sub_41914C of the file /boafrm/formWanConfigSetup of the component WAN Interface Setting Handler. The manipulation of the argument submit-url leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
- Product
- DWR-M960
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026A vulnerability was determined in D-Link DWR-M960 1.01.07.CVE-2026-2883 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability was determined in D-Link DWR-M960 1.01.07. Impacted is the function sub_427D74 of the file /boafrm/formIpQoS. Executing a manipulation of the argument submit-url can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- DWR-M960
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026A vulnerability was found in D-Link DWR-M960 1.01.07.CVE-2026-2882 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability was found in D-Link DWR-M960 1.01.07. This issue affects the function sub_46385C of the file /boafrm/formDosCfg. Performing a manipulation of the argument submit-url results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
- Product
- DWR-M960
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026A vulnerability has been found in D-Link DWR-M960 1.01.07.CVE-2026-2881 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability has been found in D-Link DWR-M960 1.01.07. This vulnerability affects the function sub_425FF8 of the file /boafrm/formFirewallAdv of the component Advanced Firewall Configuration Endpoint. Such manipulation of the argument submit-url leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- DWR-M960
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026A vulnerability was determined in D-Link DWR-M960 1.01.07.CVE-2026-2857 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability was determined in D-Link DWR-M960 1.01.07. Affected by this issue is the function sub_423E00 of the file /boafrm/formPortFw of the component Port Forwarding Configuration Endpoint. This manipulation of the argument submit-url causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
- Product
- DWR-M960
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026A vulnerability was found in D-Link DWR-M960 1.01.07.CVE-2026-2856 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability was found in D-Link DWR-M960 1.01.07. Affected by this vulnerability is the function sub_424AFC of the file /boafrm/formFilter of the component Filter Configuration Endpoint. The manipulation of the argument submit-url results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used.
- Product
- DWR-M960
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026A vulnerability has been found in D-Link DWR-M960 1.01.07.CVE-2026-2855 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability has been found in D-Link DWR-M960 1.01.07. Affected is the function sub_4648F0 of the file /boafrm/formDdns of the component DDNS Settings Handler. The manipulation of the argument submit-url leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DWR-M960
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026A flaw has been found in D-Link DWR-M960 1.01.07.CVE-2026-2854 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A flaw has been found in D-Link DWR-M960 1.01.07. This impacts the function sub_4611CC of the file /boafrm/formNtp of the component NTP Configuration Endpoint. Executing a manipulation of the argument submit-url can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been published and may be used.
- Product
- DWR-M960
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026A vulnerability was detected in D-Link DWR-M960 1.01.07.CVE-2026-2853 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability was detected in D-Link DWR-M960 1.01.07. This affects the function sub_462E14 of the file /boafrm/formSysLog of the component System Log Configuration Endpoint. Performing a manipulation of the argument submit-url results in stack-based buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.
- Product
- DWR-M960
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2025A weakness has been identified in D-Link DWR-M920, DWR-M921, DWR-M960, DIR-822K and DIR-825M 1.01.07.CVE-2025-13305 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A weakness has been identified in D-Link DWR-M920, DWR-M921, DWR-M960, DIR-822K and DIR-825M 1.01.07. This issue affects some unknown processing of the file /boafrm/formTracerouteDiagnosticRun. Executing manipulation of the argument host can lead to buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be exploited.
- Product
- DWR-M920
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2025A security flaw has been discovered in D-Link DWR-M920, DWR-M921, DWR-M960, DWR-M961 and DIR-825M 1.01.07/1.1.47.CVE-2025-13304 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A security flaw has been discovered in D-Link DWR-M920, DWR-M921, DWR-M960, DWR-M961 and DIR-825M 1.01.07/1.1.47. This vulnerability affects unknown code of the file /boafrm/formPingDiagnosticRun. Performing manipulation of the argument host results in buffer overflow. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.
- Product
- DWR-M920
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.