CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 3,078 CVEs published, 233 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
3,078
Show in the list
Critical, last 7 days
233
Show in the list
Healthcare-tagged, last 7 days
9
Show in the list
Known exploited (CISA KEV)
1,762
Show in the list

Showing CVEs that name the product draytek:vigor2960_firmware. Show all products

12 CVEs
Showing 1 to 10.
CVESeverityTitlePublished
CVE-2020-8515
Known exploited
Critical 9.8DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacter…
Assigned by mitre
Feb 1, 2020
CVE-2020-15415
Known exploited
Critical 9.8On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-pytho…
Assigned by mitre
Jun 30, 2020
CVE-2024-12987
Known exploited
High 7.3DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection
Assigned by VulDB
Dec 27, 2024
CVE-2026-113389Critical 9.9DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection
Assigned by VulDB
Oct 20, 2026
CVE-2026-113390Critical 9.9DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection
Assigned by VulDB
Oct 20, 2026
CVE-2026-113391Critical 9.9DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection
Assigned by VulDB
Oct 20, 2026
CVE-2026-113392High 7.4DrayTek Vigor2960 Apmupload mainfunction.cgi path traversal
Assigned by VulDB
Oct 20, 2026
CVE-2026-113393Medium 6.3DrayTek Vigor2960 commonupload mainfunction.cgi unrestricted upload
Assigned by VulDB
Oct 20, 2026
CVE-2026-113394High 7.4DrayTek Vigor2960 mainfunction.cgi setSWMProfile path traversal
Assigned by VulDB
Oct 20, 2026
CVE-2026-113395High 7.4DrayTek Vigor2960 swmconfigupload mainfunction.cgi cgiEscape path traversal
Assigned by VulDB
Oct 20, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.