What’s Vulnerable › Products

NousResearch hermes-agent vulnerabilities

44 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 44 published in the last 12 months.

Check whether your NousResearch hermes-agent version is affected

Latest NousResearch hermes-agent vulnerabilities

• CVE-2026-71963 — Hermes Agent 0.18.2 - 0.21.0 RCE via git core.fsmonitor Config Injection (CVSS 8.8)
• CVE-2026-85107 — NousResearch hermes-agent Electron Main Process main.ts resourceBufferFromUrl allocation of resources (CVSS 4.3)
• CVE-2026-85106 — NousResearch hermes-agent Link Title Fetch index.tsx fetchLinkTitle server-side request forgery (CVSS 6.3)
• CVE-2026-85105 — NousResearch hermes-agent Session Management s71.py _sess_nowait authorization (CVSS 7.3)
• CVE-2026-84289 — NousResearch hermes-agent MCP Tool mcp_tool.py list_tools memory allocation (CVSS 4.3)
• CVE-2026-84288 — NousResearch hermes-agent ACP Prompt Workflow session.py HermesACPAgent.prompt denial of service (CVSS 4.3)
• CVE-2026-84287 — NousResearch hermes-agent Session Chat api_server.py denial of service (CVSS 4.3)
• CVE-2026-82021 — Hermes Agent 0.18.2 < 0.19.0 MCP Catalog Supply Chain RCE via Mutable Branch Reference (CVSS 8.3)
• CVE-2026-82020 — Hermes Agent 0.16.0 < 0.17.0 Credential Store Overwrite via File-Write Tool (CVSS 6.8)
• CVE-2026-18993 — NousResearch hermes-agent Memory Toolset model_tools.py access control (CVSS 6.3)
• CVE-2026-18976 — NousResearch hermes-agent disabled_toolsets agent_init.py get_tool_definitions privileges assignment (CVSS 6.3)
• CVE-2026-18775 — NousResearch hermes-agent Browser Tooling browser_tool.py browser_snapshot server-side request forgery (CVSS 6.3)
• CVE-2026-18774 — NousResearch hermes-agent xAI Image Generation Provider image_gen_provider.py save_url_image server-side request forgery (CVSS 6.3)
• CVE-2026-18773 — NousResearch hermes-agent Quick run.py _check_slash_access authorization (CVSS 6.3)
• CVE-2026-17432 — NousResearch hermes-agent SimpleX Gateway Authorization adapter.py access control (CVSS 5.0)
• CVE-2026-15311 — NousResearch hermes-agent Matrix Adapter matrix.py MatrixAdapter._markdown_to_html cross site scripting (CVSS 3.5)
• CVE-2026-14783 — NousResearch hermes-agent skills_tool.py skill_view path traversal (CVSS 4.3)
• CVE-2026-14628 — NousResearch hermes-agent Live Webhook Endpoint base.py extract_media path traversal (CVSS 5.3)
• CVE-2026-14627 — NousResearch hermes-agent Discord Platform Integration discord.py DiscordAdapter._is_allowed_user improper authentication (CVSS 5.6)
• CVE-2026-14626 — NousResearch hermes-agent HTTP API run_agent.py AIAgent.run_conversation denial of service (CVSS 4.3)
• CVE-2026-14625 — NousResearch hermes-agent server.py shell.exec protection mechanism (CVSS 6.3)
• CVE-2026-14617 — NousResearch hermes-agent Streaming Reasoning Tag Filter stream_consumer.py GatewayStreamConsumer._filter_and_accumulate case sensitivity (CVSS 3.1)
• CVE-2026-53870 — Hermes Agent < 0.16.0 - Sensitive File Permission Vulnerability in Store Files (CVSS 5.5)
• CVE-2026-53869 — Hermes Agent < 0.16.0 - DNS Rebinding Bypass via WebSocket Endpoints (CVSS 7.5)
• CVE-2026-11461 — NousResearch hermes-agent resume Endpoint hermes_state.py resolve_session_by_title authorization (CVSS 6.3)