Advisories · Technology
nesquena hermes-webui.
Every CVE that names nesquena hermes-webui among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.3 CriticalCritical · CVSS 9+
Hermes WebUI < 0.51.307 Authentication Bypass via X-Forwarded-For Header Spoofing
- nesquena hermes-webui
- CWE-348
- CVSS 9.3 CriticalCritical · CVSS 9+
Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API
- nesquena hermes-webui
- Authentication bypass
- CVSS 6.0 Medium
Hermes WebUI < 0.51.521 - Cross-Profile Authorization Bypass via Unset Session Profile on Import
- nesquena hermes-webui
- Broken access control
- CVSS 6.9 Medium
Hermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow Endpoint
- nesquena hermes-webui
- Denial of service
- CVSS 7.1 High
Hermes WebUI < 0.51.443 - Cross-Profile Session Data Exfiltration via Session Export Endpoint
- nesquena hermes-webui
- Broken access control
- CVSS 7.1 High
Hermes WebUI < 0.51.443 - Broken Access Control in /api/session Endpoint
- nesquena hermes-webui
- Broken access control
- CVSS 8.6 High
Hermes WebUI < 0.51.368 - Profile-Scoped Authorization Bypass via Forged hermes_profile Cookie
- nesquena hermes-webui
- CWE-565
- CVSS 9.2 CriticalCritical · CVSS 9+
Hermes WebUI < 0.51.358 Unauthenticated Password Takeover via /api/settings
- nesquena hermes-webui
- Authentication bypass
- CVSS 8.7 High
Hermes WebUI < 0.51.311 RCE via Git Configuration Injection
- nesquena hermes-webui
- Command injection
- CVSS 4.3 Medium
Hermes WebUI < 0.51.303 TOCTOU Race Condition via git_discard
- nesquena hermes-webui
- Race condition
- CVSS 6.3 Medium
Hermes WebUI < 0.51.296 Workspace Boundary Bypass via api/workspace.py
- nesquena hermes-webui
- Path traversal
- CVSS 7.1 High
Hermes WebUI < 0.51.269 Profile Isolation Bypass via sessions search
- nesquena hermes-webui
- Broken access control
- CVSS 6.9 Medium
Hermes WebUI < 0.51.270 Resource Exhaustion via passkey/options
- nesquena hermes-webui
- Denial of service
- CVSS 7.1 High
Hermes WebUI before 0.51.221 Path Traversal via Symlink Workspace Bypass
- nesquena Hermes WebUI
- Path traversal
- CVSS 6.0 Medium
Hermes WebUI < 0.51.44 Path Traversal via Session Import Endpoint
- nesquena hermes-webui
- Path traversal
- CVSS 7.2 High
Nesquena Hermes WebUI Arbitrary File Deletion via Unvalidated session_id
- nesquena hermes-webui
- Path traversal
- CVSS 4.8 Medium
Nesquena Hermes WebUI Environment Variable Credential Leakage via Profile Switch
- nesquena hermes-webui
- Information disclosure
- CWE-459
- CVSS 5.3 Medium
nesquena hermes-webui Arbitrary Workspace Directory Access
- nesquena hermes-webui
- Path traversal