聚合 NVD、CVE 及多源情报，深度解析 RCE 等高危风险。系统集成 CVSS 与 EPSS 模型，动态追踪 Exploit 资源与 PoC 公开状态，研判可利用性。结合官方补丁与修复方案，优化漏洞管理优先级，缩短响应周期，保障资产安全。
分配机构（CNA / 来源）：[email protected] 移除此筛选
| CVE | 描述 | 最高 CVSS | EPSS % | 公开时间 | 更新时间 |
|---|---|---|---|---|---|
| CVE-2026-52190 | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_448384 component | 无 | 无 | 2026-07-01 | 2026-07-01 |
| CVE-2026-52186 | SQL Injection vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to execute arbitrary code via the gohead/sub_463bbc component | 无 | 无 | 2026-07-01 | 2026-07-01 |
| CVE-2026-38891 | An improper input validation in the gazebo_ros_diff_drive.cpp component of gazebo_plugins v3.9.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted geometry_msgs::Twist message. | 无 | 无 | 2026-07-01 | 2026-07-01 |
| CVE-2026-36912 | A NULL pointer dereference in the AP4_AtomSampleTable::GetSample() function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file. | 无 | 无 | 2026-07-01 | 2026-07-01 |
| CVE-2026-36911 | A division-by-zero vulnerability in the CStreamSwitcherOutputPin::DecideBufferSize function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file. | 无 | 无 | 2026-07-01 | 2026-07-01 |
| CVE-2026-36910 | An access violation in the BaseSplitterFile::Read function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file. | 无 | 无 | 2026-07-01 | 2026-07-01 |
| CVE-2026-36909 | A NULL pointer dereference in the AP4_TkhdAtom::GetTrackId() function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file. | 无 | 无 | 2026-07-01 | 2026-07-01 |
| CVE-2026-51947 | An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (fixed in Pivotal CRM 6.6.5.10 and Patch_CWE502_20260316.zip) allows a remote attacker to execute arbitrary code via the Pivotal.Engine.Client.Services.Conversion.dll component. NOTE: this issue exists because of an incomplete fix for CVE-2026-39253. | 无 | 无 | 2026-07-01 | 2026-07-01 |
| CVE-2026-38142 | An unauthenticated command injection vulnerability in the /goform/fast_setting_internet_set endpoint of Tenda AC18 v15.03.05.05 allows attackers to execute arbitrary commands via a crafted payload injected into the mac parameter. | 6.5 | 无 | 2026-07-01 | 2026-07-01 |
| CVE-2026-51946 | SQL Injection vulnerability in GoAdminGroup GoAdmin (last release v1.2.26) allows a remote attacker to execute arbitrary code and obtain sensitive information via the the __sort_type URL parameter on all /admin/info/{table} endpoints | 6.5 | 无 | 2026-07-01 | 2026-07-01 |
| CVE-2026-52198 | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_425994 component | 7.5 | 0.22% | 2026-06-30 | 2026-07-01 |
| CVE-2026-52197 | An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_44af70 component | 7.5 | 0.20% | 2026-06-30 | 2026-07-01 |
| CVE-2026-52195 | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_472f08 component | 7.5 | 0.22% | 2026-06-30 | 2026-07-01 |
| CVE-2026-52193 | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_447CAC component | 7.5 | 0.22% | 2026-06-30 | 2026-07-01 |
| CVE-2026-52196 | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_416f28 component | 7.5 | 0.22% | 2026-06-30 | 2026-07-01 |
| CVE-2026-37106 | An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account via the register function in inc/auth.php. NOTE: this is disputed by the Supplier because this is the intentional behavior when the product is configured for self-registration (a non-default feature). | 9.8 | 0.26% | 2026-06-30 | 2026-07-01 |
| CVE-2026-58374 | In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile subelement. In hostapd_process_ml_assoc_req() in src/ap/ieee802_11_eht.c, the received link_id field can be parsed as value 15, but the corresponding links[] storage only has valid entries for lower link IDs | 6.5 | 0.29% | 2026-06-30 | 2026-07-01 |
| CVE-2026-58302 | rtapi_app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation. It is installed SUID root and loads shared library modules via dlopen() by using a user-supplied module name. Insufficient validation of the module name allows path traversal, enabling an unprivileged local user to load an arbitrary shared library. Because the process retains elevated privileges during module loading, this results in local privilege escalation to root. | 8.4 | 0.15% | 2026-06-29 | 2026-06-30 |
| CVE-2026-51219 | A heap buffer overflow in the HighPriorityASDUQueue_hasUnconfirmedIMessages function of lib60870 v2.3.3 to v2.3.6 allows attackers to cause a Denial of Service (DoS) via a crafted payload. | 6.5 | 0.35% | 2026-06-29 | 2026-06-30 |
| CVE-2026-51218 | A heap buffer overflow in the TS7Worker::PerformFunctionWrite() function (/core/s7_server.cpp) of snap7 v1.4.3 allows attackers to cause a Denial of Service (DoS) via a crafted packet. | 6.5 | 0.30% | 2026-06-29 | 2026-06-30 |