What’s Vulnerable › Products

nesquena hermes-webui vulnerabilities

15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.

Check whether your nesquena hermes-webui version is affected

Latest nesquena hermes-webui vulnerabilities

• CVE-2026-58123 — Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API (CVSS 9.8)
• CVE-2026-58122 — Hermes WebUI < 0.51.307 Authentication Bypass via X-Forwarded-For Header Spoofing (CVSS 9.1)
• CVE-2026-58174 — Hermes WebUI < 0.51.521 - Cross-Profile Authorization Bypass via Unset Session Profile on Import (CVSS 6.5)
• CVE-2026-55205 — Hermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow Endpoint (CVSS 5.3)
• CVE-2026-55198 — Hermes WebUI < 0.51.443 - Cross-Profile Session Data Exfiltration via Session Export Endpoint (CVSS 6.5)
• CVE-2026-55197 — Hermes WebUI < 0.51.443 - Broken Access Control in /api/session Endpoint (CVSS 6.5)
• CVE-2026-53871 — Hermes WebUI < 0.51.368 - Profile-Scoped Authorization Bypass via Forged hermes_profile Cookie (CVSS 8.1)
• CVE-2026-49973 — Hermes WebUI < 0.51.358 Unauthenticated Password Takeover via /api/settings (CVSS 9.4)
• CVE-2026-49959 — Hermes WebUI < 0.51.311 RCE via Git Configuration Injection (CVSS 8.8)
• CVE-2026-49958 — Hermes WebUI < 0.51.303 TOCTOU Race Condition via git_discard (CVSS 5.0)
• CVE-2026-49957 — Hermes WebUI < 0.51.296 Workspace Boundary Bypass via api/workspace.py (CVSS 7.7)
• CVE-2026-49956 — Hermes WebUI < 0.51.269 Profile Isolation Bypass via sessions search (CVSS 6.5)
• CVE-2026-49955 — Hermes WebUI < 0.51.270 Resource Exhaustion via passkey/options (CVSS 5.3)
• CVE-2026-22677 — Hermes WebUI < 0.51.44 Path Traversal via Session Import Endpoint (CVSS 6.5)
• CVE-2026-6832 — Nesquena Hermes WebUI Arbitrary File Deletion via Unvalidated session_id (CVSS 8.1)