D-Link has 34 CVEs on record between 2021 and 2026. Disclosure cadence is accelerating: 32 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 26. The median CVSS is 9.1 (critical), with 21 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-119 (12) and CWE-77 (10). Most affected products: DWR-M921 (5), DIR-895L (3), DI-8400 (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 9.1
- Publish → KEV
- —
- Last 90 days
- 32 prev 0
Weakness classes
Products
- DWR-M921 5
- DIR-895L 3
- DI-8400 2
- DIR-822A 2
- DIR-868L 2
- DIR-878 2
Worst active — by depth score
CVE-2026-110536Critical· 10.0A vulnerability was determined in D-Link DIR-868L 2.01b0568CVE-2026-100740Critical· 9.9A vulnerability was detected in D-Link DIR-895L A1_102b0767CVE-2026-94089Critical· 10.0A vulnerability was determined in D-Link DIR-868L 2.01b0567CVE-2026-91001Critical· 9.9A security flaw has been discovered in D-Link DI-8400 16.0767CVE-2026-90699Critical· 9.9A weakness has been identified in D-Link DWR-M920 1.1.767
D-Link vulnerabilities
CVEs affecting D-Link, newest first. Open any entry for full detail, references, and exploit status.
34 CVEsRSS
CVE-2026-86296Critical· 10.0PoCA vulnerability was determined in D-Link DIR-822A A_101
A vulnerability was determined in D-Link DIR-822A A_101. This vulnerability affects the function strcpy of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack is poss…
CVE-2026-86295High· 8.3PoCA vulnerability was found in D-Link DIR-895L A1_102b07
A vulnerability was found in D-Link DIR-895L A1_102b07. This affects the function sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. The manipulation of the argument Hostname results in command injection. The attack can…
CVE-2023-53974High· 7.5PoCD-Link DSL-124 ME_1.00 Backup Configuration File Disclosure via Unauthenticated Request
D-Link DSL-124 ME_1.00 contains a configuration file disclosure vulnerability that allows unauthenticated attackers to retrieve router settings through a POST request. Attackers can send a specific POST request to the router's configurat…
CVE-2021-33259Medium· 5.3Several web interfaces in D-Link DIR-868LW 1.12b have no authentication requirements for access, allowing for attackers to obtain users' DNS query history.
Several web interfaces in D-Link DIR-868LW 1.12b have no authentication requirements for access, allowing for attackers to obtain users' DNS query history.