Priority HIGH 68
The webhook platform gateway in Nous Research Hermes Agent versions builds the session chat_id as webhook:{route_name}:{delivery_id} and re-derives the authorizing route by splitting that string, so a route name containi…
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.00691 · Published 2026-10-21 · No fix listed CWE-863
Priority HIGH 72
Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/c…
CVSS 4.0HIGH 8.6· Network · No auth · User interaction · EPSS 0.00858 · Published 2026-09-03 · Fixed CWE-78
Priority LOW 25
A vulnerability was found in NousResearch hermes-agent 0.18.0.
CVSS 4.0MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.0051 · Published 2026-09-03 · No fix listed CWE-400
Priority LOW 24
A vulnerability has been found in NousResearch hermes-agent 0.18.0.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00347 · Published 2026-09-03 · No fix listed CWE-918
Priority LOW 37
A flaw has been found in NousResearch hermes-agent 0.18.0.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00495 · Published 2026-09-03 · No fix listed CWE-285
Priority MEDIUM 57
A vulnerability was found in NousResearch hermes-agent up to 0.18.2.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00471 · Published 2026-09-01 · No fix listed CWE-400
Priority MEDIUM 57
A vulnerability has been found in NousResearch hermes-agent up to 0.18.2.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00471 · Published 2026-09-01 · No fix listed CWE-404
Priority MEDIUM 57
A flaw has been found in NousResearch hermes-agent 0.18.0.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00521 · Published 2026-09-01 · No fix listed CWE-404
Priority MEDIUM 41
Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced vi…
CVSS 4.0CRITICAL 9.0· Network · No auth · User interaction · EPSS 0.00339 · Published 2026-08-28 · Fixed in 0.19.0, 2026.7.20 CWE-494
Priority LOW 36
Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guard…
CVSS 4.0HIGH 7.6· Network · No auth · User interaction · EPSS 0.00435 · Published 2026-08-28 · Fixed in 0.17.0, 2026.6.19 CWE-552
Priority MEDIUM 57
A vulnerability was detected in NousResearch hermes-agent up to 0.16.0.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00374 · Published 2026-08-06 · No fix listed CWE-266
Priority MEDIUM 57
A vulnerability was determined in NousResearch hermes-agent up to 0.16.0.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00366 · Published 2026-08-06 · No fix listed CWE-266
Priority MEDIUM 57
A vulnerability has been found in NousResearch hermes-agent up to 0.16.0.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00378 · Published 2026-08-04 · No fix listed CWE-918
Priority MEDIUM 57
A flaw has been found in NousResearch hermes-agent up to 0.16.0.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00347 · Published 2026-08-04 · No fix listed CWE-918
Priority MEDIUM 57
A vulnerability was detected in NousResearch hermes-agent up to 2026.6.5.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00347 · Published 2026-08-04 · No fix listed CWE-285
Priority MEDIUM 45
A vulnerability was detected in NousResearch hermes-agent 2026.6.5.
CVSS 4.0LOW 2.3· Network · Low privileges · No interaction · EPSS 0.00362 · Published 2026-07-26 · No fix listed CWE-266
Priority MEDIUM 56
A vulnerability was identified in NousResearch hermes-agent up to 2026.5.29.2.
CVSS 4.0MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00356 · Published 2026-07-09 · No fix listed CWE-79
Priority MEDIUM 57
A vulnerability was determined in NousResearch hermes-agent 2026.5.29.2.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00478 · Published 2026-07-05 · No fix listed CWE-22
Priority HIGH 70
A vulnerability was detected in NousResearch hermes-agent up to 2026.5.16.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00767 · Published 2026-07-04 · No fix listed CWE-22
Priority MEDIUM 61
A security vulnerability has been detected in NousResearch hermes-agent up to 0.15.2.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00554 · Published 2026-07-04 · No fix listed CWE-287
Priority MEDIUM 57
A weakness has been identified in NousResearch hermes-agent up to 2026.4.30.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00471 · Published 2026-07-04 · No fix listed CWE-404
Priority MEDIUM 57
A security flaw has been discovered in NousResearch hermes-agent up to 0.15.2.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00379 · Published 2026-07-04 · No fix listed CWE-693
Priority MEDIUM 45
A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30.
CVSS 4.0LOW 2.3· Network · Low privileges · No interaction · EPSS 0.00374 · Published 2026-07-03 · No fix listed CWE-178
Priority MEDIUM 63
Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644), exposing conversation history and HMAC secrets to local users.
CVSS 4.0MEDIUM 6.8· Local · Low privileges · No interaction · EPSS 0.0016 · Published 2026-06-17 · Fixed in 0.16.0 CWE-276
Priority MEDIUM 44
Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00592 · Published 2026-06-17 · Fixed in 0.16.0 CWE-306
Load more
THREATIST.IORead the docs