CVE-2026-16327: HIGH (CVSS 7.3)

Echelongraph • July 21, 2026

Score 7.3 from GitHub Security Advisory published 2026-07-21. a secondary CVSS source baseline 7.3; sources differ by 0.0.

No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.

A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/web_file/upload.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown...

MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

Explore the affected products and dependency analysis for CVE-2026-16327

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities Disclosed: CVE-2026-16327 and CVE-2026-65687 Two significant vulnerabilities have been reported: CVE-2026-16327 in D-Link DNS-320 and CVE-2026-65687 in Bold Reports Standalone Report Designer. CVE-2026-16327, with a CVSS score of 7.3, allows remote attackers to exploit unrestricted file uploads, while CVE-2026-65687, rated at 9.8, enables unauthenticated access to sensitive files through path traversal. The D-Link vulnerability has no vendor fix yet, and users are advised to implement workarounds. In contrast, the Bold Reports vulnerability has not confirmed active exploitation, but it poses a severe risk due to potential unauthorized access to sensitive data. Both vulnerabilities have been publicly disclosed, increasing the urgency for organizations to assess their exposure and apply necessary mitigations. 2 sources 71

Extracted Entities

CVE-2026-16327: HIGH (CVSS 7.3)

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (2)