CVE-2025-34104

Piwik Authenticated RCE via Custom Plugin Upload

An authenticated remote code execution vulnerability exists in Piwik (now Matomo) versions prior to 3.0.3 via the plugin upload mechanism. In vulnerable versions, an authenticated user with Superuser privileges can upload and activate a malicious plugin (ZIP archive), leading to arbitrary PHP code execution on the underlying system. Starting with version 3.0.3, plugin upload functionality is disabled by default unless explicitly enabled in the configuration file.

CVSS 4.0 · 9.4 Critical EPSS 1.9% KEV · Not listed

Vendors

Matomo Oracle Piwik

Products

Matomo Web Analytics Piwik

CVE-2025-34067

Hikvision Integrated Security Management Platform Remote Command Execution via applyCT Fastjson

An unauthenticated remote command execution vulnerability exists in the applyCT component of the Hikvision Integrated Security Management Platform due to the use of a vulnerable version of the Fastjson library. The endpoint /bic/ssoService/v1/applyCT deserializes untrusted user input, allowing an attacker to trigger Fastjson's auto-type feature to load arbitrary Java classes. By referencing a malicious class via an LDAP URL, an attacker can achieve remote code execution on the underlying system. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.

CVSS 4.0 · 10 Critical EPSS 22.0% KEV · Not listed

Vendors

Avaya

Products

Integrated Management

CVE-2025-34058

Hikvision Streaming Media Management Server Default Credentials and Authenticated Arbitrary File Read

Hikvision Streaming Media Management Server v2.3.5 uses default credentials that allow remote attackers to authenticate and access restricted functionality. After authenticating with these credentials, an attacker can exploit an arbitrary file read vulnerability in the /systemLog/downFile.php endpoint via directory traversal in the fileName parameter. This exploit chain can enable unauthorized access to sensitive system files.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Live555

Products

Streaming Media

CVE-2025-34046

Fanwei E-Office Unauthenticated File Upload

An unauthenticated file upload vulnerability exists in the Fanwei E-Office <= v9.4 web management interface. The vulnerability affects the /general/index/UploadFile.php endpoint, which improperly validates uploaded files when invoked with certain parameters (uploadType=eoffice_logo or uploadType=theme). An attacker can exploit this flaw by sending a crafted HTTP POST request to upload arbitrary files without requiring authentication. Successful exploitation could enable remote code execution on the affected server, leading to complete compromise of the web application and potentially the underlying system. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Weaver

Products

E-office

CVE-2025-34043

Vacron NVR Remote Command Execution

A remote command injection vulnerability exists in Vacron Network Video Recorder (NVR) devices v1.4 due to improper input sanitization in the board.cgi script. The vulnerability allows unauthenticated attackers to pass arbitrary commands to the underlying operating system via crafted HTTP requests. These commands are executed with the privileges of the web server process, enabling remote code execution and potential full device compromise. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.

CVSS 4.0 · 10 Critical EPSS 7.5% KEV · Not listed

Vendors

Nuuo

Products

Network Video Recorder

CVE-2025-34041

Sangfor Endpoint Detection and Response OS Command Injection

An OS command injection vulnerability exists in the Chinese versions of Sangfor Endpoint Detection and Response (EDR) management platform versions 3.2.16, 3.2.17, and 3.2.19. The vulnerability allows unauthenticated attackers to construct and send malicious HTTP requests to the EDR Manager interface, leading to arbitrary command execution with elevated privileges. This flaw only affects the Chinese-language EDR builds. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-04 UTC.

CVSS 4.0 · 10 Critical EPSS 7.5% KEV · Not listed

Vendors

Symantec

Products

Endpoint Detection And Response

CVE-2025-15645

Ledger Nano X, Flex, Stax MCU Firmware Update Denial of Service

Ledger Nano X, Flex, and Stax devices contain a denial of service vulnerability in the MCU firmware update process due to missing validation of the reset_handler parameter during firmware flashing. An attacker can provide a crafted reset_handler address pointing to invalid memory or attacker-controlled code to cause the device to enter an unrecoverable fault state during boot, resulting in permanent loss of operability.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Ledger Ledger-cli

Products

Flex Nano X Stax and 1 more

CVE-2025-15620

HiOS Switch Platform Denial-of-Service via Web Interface

HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.00 contain a denial-of-service vulnerability in the web interface that allows remote attackers to reboot the affected device by sending a malicious HTTP GET request to a specific endpoint. Attackers can trigger an uncontrolled reboot condition through crafted HTTP requests to cause service disruption and unavailability of the switch.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Belden

Products

Hios Switch Hirschmann Hios Hirschmann Hios Switch Platform

CVE-2026-8696

radare2 6.1.5 Use-After-Free via gdbr_pids_list()

radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_pids_list() function within the GDB client core that allows remote attackers to cause a denial of service or potentially execute arbitrary code by sending malformed thread information responses. Attackers can trigger the vulnerability by causing qsThreadInfo to fail after qfThreadInfo successfully allocates RDebugPid structures, resulting in double-free memory corruption when the error path attempts to clean up the list.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Radare

Products

Radare2

CVE-2026-8695

radare2 6.1.5 Use-After-Free via gdbr_threads_list()

radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_threads_list() function that allows remote attackers to trigger memory corruption by sending a valid qfThreadInfo response followed by a malformed qsThreadInfo response. Attackers can exploit this vulnerability through GDB remote debugging to cause a denial of service or potentially achieve code execution by manipulating thread list processing.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Radare

Products

Radare2

CVE-2026-8430

SPIP < 4.4.14 Remote Code Execution via nginx

SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the public space that is limited to certain nginx configurations, allowing attackers to execute arbitrary code in the context of the web server. Attackers can exploit this vulnerability through specific nginx configuration scenarios to achieve code execution, and this issue is not mitigated by the SPIP security screen.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Spip

Products

Spip

CVE-2026-8429

SPIP < 4.4.14 Remote Code Execution via Private Space

SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the private space that allows attackers to execute arbitrary code in the context of the web server. Attackers can exploit this vulnerability to achieve code execution that bypasses the SPIP security screen protections.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Spip

Products

Spip

CVE-2026-6830

Nesquena Hermes WebUI Environment Variable Credential Leakage via Profile Switch

nesquena hermes-webui contains an environment variable leakage vulnerability where profile switching does not clear environment variables from the previously active profile before loading the next profile. Attackers or users can exploit additive dotenv reload behavior to access provider API keys and other sensitive secrets from one profile context in another profile, breaking expected security isolation between profiles.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Get-hermes Nesquena

Products

Hermes Web Ui Hermes-webui

CVE-2026-6829

nesquena hermes-webui Arbitrary Workspace Directory Access

nesquena hermes-webui contains a trust-boundary failure vulnerability that allows authenticated attackers to set or change a session workspace to an arbitrary existing directory on disk by manipulating workspace path parameters in endpoints such as /api/session/new, /api/session/update, /api/chat/start, and /api/workspaces/add. Attackers can repoint a session workspace to a directory outside the intended trusted root and then use ordinary file read and write APIs to access or modify files outside the intended workspace boundary within the permissions of the hermes-webui process.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Get-hermes Nesquena

Products

Hermes Web Ui Hermes-webui

CVE-2026-6249

Vvveb CMS 1.0.8.2 Remote Code Execution via Media Upload

Vvveb CMS 1.0.8.2 contains a remote code execution vulnerability in its media upload handler that allows authenticated attackers to execute arbitrary operating system commands by uploading a PHP webshell with a .phtml extension. Attackers can bypass the extension deny-list and upload malicious files to the publicly accessible media directory, then request the file over HTTP to achieve full server compromise.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Vvveb

Products

Vvveb

CVE-2026-61876

LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting

LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administrator's browser when viewing DHCP lease pages.

CVSS 4.0 · 9.4 Critical EPSS 1.6% KEV · Not listed

Vendors

Openwrt

Products

Luci

CVE-2026-61875

luci-app-upnp Stored XSS via UPnP Port Mapping Description

luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOAP requests. Attackers can send malicious HTML in the NewPortMappingDescription field, which miniupnpd stores and luci-app-upnp renders without output encoding, executing the payload when administrators view the UPnP or Status pages.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Openwrt

Products

Luci

CVE-2026-61874

filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete

filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose new contents through the dormant public share URL.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Filebrowser

Products

Filebrowser

CVE-2026-61461

Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text

Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the search_by_full_text method without escaping or parameterization. Attackers can inject malicious SQL through the search parameters to read, modify, or delete data in the underlying ClickHouse database.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Dify Langgenius

Products

Dify Dify

CVE-2026-61459

MCP Server Kubernetes < 3.9.0 Argument Injection via kubectl Structured Tools

MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can inject the --server flag to redirect kubectl commands to an attacker-controlled API server, causing the operator's bearer token to be transmitted externally and enabling full cluster compromise.

CVSS 4.0 · 9.3 Critical EPSS 2.4% KEV · Not listed

Vendors

Flux159 Suyogs

Products

Mcp-server-kubernetes Mcp-server-kubernetes