← Blog

Refresh: a critical Shinobi CVE, an Agent DVR RCE flaw, and two Nx Witness session-hijack bugs

2026-10-01

This cycle we refreshed Shinobi, Agent DVR, Viseron, Xeoma, and Nx Witness — the five entries whose sources had gone untouched since our very first pass in July 2026. Here's what changed:

**Shinobi**: a critical, unauthenticated vulnerability (CVE-2026-82448, CVSS 9.3) was disclosed on 29 August 2026. A hardcoded key on Shinobi's child-node WebSocket handshake let an attacker dispatch arbitrary database queries, reading and modifying user accounts and camera configuration without any credentials. It's fixed in commit 5a76c74f — anyone running a self-hosted Shinobi instance should update now. Licensing (GPLv3/AGPLv3 core, proprietary Pro EULA) is unchanged.

**Agent DVR**: a high-severity directory-traversal/SSRF/RCE flaw (CVE-2025-63408, CVSS 7.8) affects versions up to 6.6.1.0, allowing a local attacker to read sensitive files, forge server-side requests, or run OS commands. Subscription pricing ($7.95/$14.95/$19.95 per month) and the free local tier are unchanged.

**Viseron**: two real releases landed since our baseline — v3.6.0 (10 August) added configuration reload without a container restart, external PostgreSQL support, and personal-access-token API auth; v3.7.0 (17 September) added an ONVIF component with PTZ camera control and local, fully offline licence-plate recognition via FastALPR. At-rest encryption of recordings is still undocumented.

**Xeoma**: Felenasoft rolled out a new flagship face-recognition method called "Vision", advertised at up to 99% accuracy, and shipped a Time-and-Attendance module in April 2026 that logs staff arrivals and departures from face recognition. The product remains closed-source, and encryption of stored footage at rest is still not documented.

**Nx Witness**: two high-severity, 2026-disclosed vulnerabilities that both lead to administrator account takeover — CVE-2026-78414 (stored XSS in the "merge with another site" dialog, CVSS 8.0, fixed in 6.1.3) and CVE-2026-10056 (a CORS misconfiguration in the REST API under default Standard security mode, CVSS 7.5, fixed in 6.1.2). Deployments should be on 6.1.3 or later.

**Noviscan cross-check**: none of this cycle's facts — CVE disclosures and feature additions on competing products — touch any existing claim in our own Noviscan entry, so no correction was needed there this time.