nesquena vulnerabilities

Products

• nesquena/hermes-webui 18
• Hermes WebUI 1

Latest nesquena CVEs

Newest publication first

1. CVE-2026-58122 Hermes WebUI < 0.51.307 Authentication Bypass via X-Forwarded-For Header Spoofing

   Published 2026-07-09

   Critical·CVSS 9.3 EPSS 0.37%

   Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to circumvent local-origin IP restrictions on onboarding endpoints by supplying a spoofed X-Forwarded-For header with a loopback address. Attackers can exploi...

2. CVE-2026-58123 Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API

   Published 2026-07-09

   Critical·CVSS 9.3 EPSS 4.6%

   Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by accessing the embedded terminal API endpoints without credentials. Attackers can create a session, attach a PTY shell,...

3. CVE-2026-58174 Hermes WebUI < 0.51.521 - Cross-Profile Authorization Bypass via Unset Session Profile on Import

   Published 2026-06-30

   Medium·CVSS 6.0 EPSS 0.45%

   Hermes WebUI before 0.51.521 validates the workspace of an imported session under the active named profile but constructs the Session object without setting its profile in the /api/session/import handler, so the imported session is persisted with a null profile. Because a null pr...

4. CVE-2026-55205 Hermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow Endpoint

   Published 2026-06-18

   Medium·CVSS 6.9 EPSS 0.52%

   Hermes WebUI before 0.51.468 contains a resource exhaustion vulnerability in the unauthenticated POST /api/onboarding/oauth/start endpoint that allows unbounded accumulation of in-memory flow state and daemon threads. Attackers can send repeated or concurrent requests to exhaust...

5. CVE-2026-55198 Hermes WebUI < 0.51.443 - Cross-Profile Session Data Exfiltration via Session Export Endpoint

   Published 2026-06-17

   High·CVSS 7.1 EPSS 0.35%

   Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export endpoint that allows authenticated users to access sessions from other profiles. The _handle_session_export handler in api/routes.py fails to verify active-profile ownership before s...

6. CVE-2026-55197 Hermes WebUI < 0.51.443 - Broken Access Control in /api/session Endpoint

   Published 2026-06-17

   High·CVSS 7.1 EPSS 0.35%

   Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session endpoint that allows authenticated users to disclose cross-profile session transcripts. Attackers can bypass profile boundary checks by directly querying session IDs belonging to other...

7. CVE-2026-55196 Hermes WebUI < 0.51.409 - Unauthenticated Passkey Registration via Authentication Bypass

   Published 2026-06-17

   Critical·CVSS 9.1 EPSS 0.58%

   Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary passkeys. When HERMES_WEBUI_PASSKEY=1 is enabled with no existing credentials, POST /api/auth/passkey/...

8. CVE-2026-53871 Hermes WebUI < 0.51.368 - Profile-Scoped Authorization Bypass via Forged hermes_profile Cookie

   Published 2026-06-17

   High·CVSS 8.6 EPSS 0.37%

   Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get_profile_cookie() function that accepts unauthenticated profile names from the hermes_profile cookie. An authenticated attacker can forge the hermes_profile cookie value to bypass profile-scoped...

9. CVE-2026-49973 Hermes WebUI < 0.51.358 Unauthenticated Password Takeover via /api/settings

   Published 2026-06-11

   Critical·CVSS 9.2 EPSS 0.54%

   Hermes WebUI before version 0.51.358 contains an improper access control vulnerability that allows unauthenticated remote attackers to hijack initial setup by submitting the _set_password parameter to the settings API endpoint without any network origin restriction. Attackers on...

10. CVE-2026-49959 Hermes WebUI < 0.51.311 RCE via Git Configuration Injection

    Published 2026-06-09

    High·CVSS 8.7 EPSS 0.95%

    Hermes WebUI before version 0.51.311 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by placing malicious executable Git configuration in a workspace repository's .git/config file. Attackers can exploit Git subproce...

11. CVE-2026-49958 Hermes WebUI < 0.51.303 TOCTOU Race Condition via git_discard

    Published 2026-06-09

    Medium·CVSS 4.3 EPSS 0.08%

    Hermes WebUI before version 0.51.303 contains a time-of-check time-of-use (TOCTOU) race condition vulnerability in the git_discard function within api/workspace_git.py that allows attackers to delete files outside the configured workspace boundary by replacing a validated path co...

12. CVE-2026-49957 Hermes WebUI < 0.51.296 Workspace Boundary Bypass via api/workspace.py

    Published 2026-06-09

    Medium·CVSS 6.3 EPSS 0.42%

    Hermes WebUI before version 0.51.296 contains a workspace boundary bypass vulnerability that allows authenticated attackers to circumvent blocked-root path checks by exploiting an early return in the SSH/remote terminal profile workspace resolution logic within _remote_terminal_w...

13. CVE-2026-49956 Hermes WebUI < 0.51.269 Profile Isolation Bypass via sessions search

    Published 2026-06-09

    High·CVSS 7.1 EPSS 0.27%

    Hermes WebUI before version 0.51.269 contains a profile isolation bypass vulnerability that allows authenticated users to access data belonging to other profiles by querying the session search endpoint without active-profile filtering. Attackers can send requests to the sessions...

14. CVE-2026-49955 Hermes WebUI < 0.51.270 Resource Exhaustion via passkey/options

    Published 2026-06-09

    Medium·CVSS 6.9 EPSS 0.59%

    Hermes WebUI before version 0.51.270 contains a resource exhaustion vulnerability that allows unauthenticated remote attackers to degrade service availability by repeatedly calling the passkey options endpoint without completing assertion. Attackers can send unlimited POST reques...

15. CVE-2026-11322 Hermes WebUI before 0.51.221 Path Traversal via Symlink Workspace Bypass

    Published 2026-06-04

    High·CVSS 7.1 EPSS 0.32%

    Hermes WebUI prior to v0.51.221 contains a path traversal vulnerability that allows attackers to escape the workspace boundary by supplying symlinks that resolve to files or directories outside the designated workspace root. Attackers can exploit the workspace file and listing AP...

16. CVE-2026-22677 Hermes WebUI < 0.51.44 Path Traversal via Session Import Endpoint

    Published 2026-05-13

    Medium·CVSS 6.0 EPSS 0.38%

    Hermes WebUI prior to 0.51.44 contains a path traversal vulnerability in the session import endpoint that allows authenticated attackers to read arbitrary files by importing a crafted session with an unrestricted workspace value. Attackers can supply a blocked filesystem root in...

17. CVE-2026-6832 Nesquena Hermes WebUI Arbitrary File Deletion via Unvalidated session_id

    Published 2026-04-21

    High·CVSS 7.2 EPSS 0.48%

    Hermes WebUI contains an arbitrary file deletion vulnerability in the /api/session/delete endpoint that allows authenticated attackers to delete files outside the session directory by supplying an absolute path or path traversal payload in the session_id parameter. Attackers can...

18. CVE-2026-6830 Nesquena Hermes WebUI Environment Variable Credential Leakage via Profile Switch

    Published 2026-04-21

    Medium·CVSS 4.8 EPSS 0.11%

    nesquena hermes-webui contains an environment variable leakage vulnerability where profile switching does not clear environment variables from the previously active profile before loading the next profile. Attackers or users can exploit additive dotenv reload behavior to access p...

19. CVE-2026-6829 nesquena hermes-webui Arbitrary Workspace Directory Access

    Published 2026-04-21

    Medium·CVSS 5.3 EPSS 0.26%

    nesquena hermes-webui contains a trust-boundary failure vulnerability that allows authenticated attackers to set or change a session workspace to an arbitrary existing directory on disk by manipulating workspace path parameters in endpoints such as /api/session/new, /api/session/...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.