agentprime: nesquena-hermes-webuiEvery new CVE for nesquena-hermes-webui.https://agentprime.io/CVE-2026-58122: Hermes WebUI < 0.51.307 Authentication Bypass via X-Forwarded-For Header Spoofinghttps://agentprime.io/advisories/CVE-2026-58122/https://agentprime.io/advisories/CVE-2026-58122/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 09 Jul 2026 21:30:17 GMTCVEcriticalCVE-2026-58123: Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal APIhttps://agentprime.io/advisories/CVE-2026-58123/https://agentprime.io/advisories/CVE-2026-58123/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 09 Jul 2026 21:14:06 GMTCVEcriticalCVE-2026-58174: Hermes WebUI < 0.51.521 - Cross-Profile Authorization Bypass via Unset Session Profile on Importhttps://agentprime.io/advisories/CVE-2026-58174/https://agentprime.io/advisories/CVE-2026-58174/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 30 Jun 2026 15:55:54 GMTCVECVE-2026-55205: Hermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow Endpointhttps://agentprime.io/advisories/CVE-2026-55205/https://agentprime.io/advisories/CVE-2026-55205/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 18 Jun 2026 15:49:04 GMTCVECVE-2026-55198: Hermes WebUI < 0.51.443 - Cross-Profile Session Data Exfiltration via Session Export Endpointhttps://agentprime.io/advisories/CVE-2026-55198/https://agentprime.io/advisories/CVE-2026-55198/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 17 Jun 2026 17:59:25 GMTCVECVE-2026-55197: Hermes WebUI < 0.51.443 - Broken Access Control in /api/session Endpointhttps://agentprime.io/advisories/CVE-2026-55197/https://agentprime.io/advisories/CVE-2026-55197/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 17 Jun 2026 17:59:10 GMTCVECVE-2026-53871: Hermes WebUI < 0.51.368 - Profile-Scoped Authorization Bypass via Forged hermes_profile Cookiehttps://agentprime.io/advisories/CVE-2026-53871/https://agentprime.io/advisories/CVE-2026-53871/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 17 Jun 2026 17:58:29 GMTCVECVE-2026-49973: Hermes WebUI < 0.51.358 Unauthenticated Password Takeover via /api/settingshttps://agentprime.io/advisories/CVE-2026-49973/https://agentprime.io/advisories/CVE-2026-49973/CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 11 Jun 2026 19:04:08 GMTCVEcriticalCVE-2026-49959: Hermes WebUI < 0.51.311 RCE via Git Configuration Injectionhttps://agentprime.io/advisories/CVE-2026-49959/https://agentprime.io/advisories/CVE-2026-49959/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 09 Jun 2026 16:46:03 GMTCVECVE-2026-49958: Hermes WebUI < 0.51.303 TOCTOU Race Condition via git_discardhttps://agentprime.io/advisories/CVE-2026-49958/https://agentprime.io/advisories/CVE-2026-49958/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 09 Jun 2026 16:35:42 GMTCVECVE-2026-49957: Hermes WebUI < 0.51.296 Workspace Boundary Bypass via api/workspace.pyhttps://agentprime.io/advisories/CVE-2026-49957/https://agentprime.io/advisories/CVE-2026-49957/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 09 Jun 2026 16:25:10 GMTCVECVE-2026-49956: Hermes WebUI < 0.51.269 Profile Isolation Bypass via sessions searchhttps://agentprime.io/advisories/CVE-2026-49956/https://agentprime.io/advisories/CVE-2026-49956/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 09 Jun 2026 16:10:33 GMTCVECVE-2026-49955: Hermes WebUI < 0.51.270 Resource Exhaustion via passkey/optionshttps://agentprime.io/advisories/CVE-2026-49955/https://agentprime.io/advisories/CVE-2026-49955/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 09 Jun 2026 16:05:33 GMTCVECVE-2026-11322: Hermes WebUI before 0.51.221 Path Traversal via Symlink Workspace Bypasshttps://agentprime.io/advisories/CVE-2026-11322/https://agentprime.io/advisories/CVE-2026-11322/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 04 Jun 2026 21:58:47 GMTCVECVE-2026-22677: Hermes WebUI < 0.51.44 Path Traversal via Session Import Endpointhttps://agentprime.io/advisories/CVE-2026-22677/https://agentprime.io/advisories/CVE-2026-22677/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 13 May 2026 19:08:02 GMTCVECVE-2026-6832: Nesquena Hermes WebUI Arbitrary File Deletion via Unvalidated session_idhttps://agentprime.io/advisories/CVE-2026-6832/https://agentprime.io/advisories/CVE-2026-6832/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Apr 2026 21:44:55 GMTCVECVE-2026-6830: Nesquena Hermes WebUI Environment Variable Credential Leakage via Profile Switchhttps://agentprime.io/advisories/CVE-2026-6830/https://agentprime.io/advisories/CVE-2026-6830/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Apr 2026 21:33:28 GMTCVECVE-2026-6829: nesquena hermes-webui Arbitrary Workspace Directory Accesshttps://agentprime.io/advisories/CVE-2026-6829/https://agentprime.io/advisories/CVE-2026-6829/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Apr 2026 21:09:59 GMTCVE