Nesquena vulnerabilities

Products

• Hermes-webui 18

Newest

• nesquena hermes-webui Hermes WebUI < 0.51.307 Authentication Bypass via X-Forwarded-For Header Spoofing CVE-2026-58122 9.3 CriticalJuly 9, 2026
• nesquena hermes-webui Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API CVE-2026-58123 9.3 CriticalJuly 9, 2026
• nesquena hermes-webui Hermes WebUI < 0.51.521 - Cross-Profile Authorization Bypass via Unset Session Profile on Import CVE-2026-58174 6.0 MediumJune 30, 2026
• nesquena hermes-webui Hermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow Endpoint CVE-2026-55205 6.9 MediumJune 18, 2026
• nesquena hermes-webui Hermes WebUI < 0.51.443 - Cross-Profile Session Data Exfiltration via Session Export Endpoint CVE-2026-55198 7.1 HighJune 17, 2026
• nesquena hermes-webui Hermes WebUI < 0.51.443 - Broken Access Control in /api/session Endpoint CVE-2026-55197 7.1 HighJune 17, 2026
• hermes-webui Hermes WebUI < 0.51.409 - Unauthenticated Passkey Registration via Authentication Bypass CVE-2026-55196 9.1 CriticalJune 17, 2026
• nesquena hermes-webui Hermes WebUI < 0.51.368 - Profile-Scoped Authorization Bypass via Forged hermes_profile Cookie CVE-2026-53871 8.6 HighJune 17, 2026
• nesquena hermes-webui Hermes WebUI < 0.51.358 Unauthenticated Password Takeover via /api/settings CVE-2026-49973 9.2 CriticalJune 11, 2026
• nesquena hermes-webui Hermes WebUI < 0.51.311 RCE via Git Configuration Injection CVE-2026-49959 8.7 HighJune 9, 2026
• nesquena hermes-webui Hermes WebUI < 0.51.303 TOCTOU Race Condition via git_discard CVE-2026-49958 4.3 MediumJune 9, 2026
• nesquena hermes-webui Hermes WebUI < 0.51.296 Workspace Boundary Bypass via api/workspace.py CVE-2026-49957 6.3 MediumJune 9, 2026
• nesquena hermes-webui Hermes WebUI < 0.51.269 Profile Isolation Bypass via sessions search CVE-2026-49956 7.1 HighJune 9, 2026
• nesquena hermes-webui Hermes WebUI < 0.51.270 Resource Exhaustion via passkey/options CVE-2026-49955 6.9 MediumJune 9, 2026
• nesquena hermes webui Hermes WebUI before 0.51.221 Path Traversal via Symlink Workspace Bypass CVE-2026-11322 7.1 HighJune 4, 2026
• nesquena hermes-webui Hermes WebUI < 0.51.44 Path Traversal via Session Import Endpoint CVE-2026-22677 6.0 MediumMay 13, 2026
• get-hermes hermes web ui, nesquena hermes-webui +1 more Nesquena Hermes WebUI Arbitrary File Deletion via Unvalidated session_id CVE-2026-6832 7.2 HighApril 21, 2026
• nesquena hermes-webui Nesquena Hermes WebUI Environment Variable Credential Leakage via Profile Switch CVE-2026-6830 4.8 MediumApril 21, 2026
• nesquena hermes-webui nesquena hermes-webui Arbitrary Workspace Directory Access CVE-2026-6829 5.3 MediumApril 21, 2026