nesquena vulnerabilities

Newest CVEs

• CVE-2026-58122

  Hermes WebUI < 0.51.307 Authentication Bypass via X-Forwarded-For Header Spoofing

  nesquena · hermes-webui

  Critical9.3
• CVE-2026-58123

  Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API

  nesquena · hermes-webui

  Critical9.3
• CVE-2026-58174

  Hermes WebUI < 0.51.521 - Cross-Profile Authorization Bypass via Unset Session Profile on Import

  nesquena · hermes-webui

  Medium6.0
• CVE-2026-55205

  Hermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow Endpoint

  nesquena · hermes-webui

  Medium6.9
• CVE-2026-55198

  Hermes WebUI < 0.51.443 - Cross-Profile Session Data Exfiltration via Session Export Endpoint

  nesquena · hermes-webui

  High7.1
• CVE-2026-55197

  Hermes WebUI < 0.51.443 - Broken Access Control in /api/session Endpoint

  nesquena · hermes-webui

  High7.1
• CVE-2026-53871

  Hermes WebUI < 0.51.368 - Profile-Scoped Authorization Bypass via Forged hermes_profile Cookie

  nesquena · hermes-webui

  High8.6
• CVE-2026-49973

  Hermes WebUI < 0.51.358 Unauthenticated Password Takeover via /api/settings

  nesquena · hermes-webui

  Critical9.2
• CVE-2026-49959

  Hermes WebUI < 0.51.311 RCE via Git Configuration Injection

  nesquena · hermes-webui

  High8.7
• CVE-2026-49958

  Hermes WebUI < 0.51.303 TOCTOU Race Condition via git_discard

  nesquena · hermes-webui

  Medium4.3