39
CVEs
1
Critical
3
High
0
KEV
33
PoC
0
Unpatched C/H
46.2%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
3
MEDIUM
16
LOW
19
Monthly CVE Trend
Affected Products (2)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-71963 | Remote code execution in NousResearch Hermes Agent 0.18.2-0.21.0 allows an unauthenticated attacker to execute arbitrary OS commands in the victim's process context by supplying a malicious git repository containing a crafted `.git/config` that sets `core.fsmonitor` to an attacker-controlled binary or script. Exploitation is triggered the moment a user opens the malicious repository and sends any message, causing the agent's internal git status call to invoke the injected command and expose the full process environment - including configured LLM provider API keys. A public exploit writeup exists (manifold.security), and a patch was released as commit f6234d0. | HIGH | 8.6 | 0.9% | 64 |
PoC
|
| CVE-2026-9367 | Remote command injection in NousResearch hermes-agent allows unauthenticated attackers to execute arbitrary OS commands through the terminal_tool component's approval mechanism. The vulnerability affects all versions up to commit 5157f5427f19488b31c6fdebbacd15d798ce7f63 and has publicly available exploit code demonstrating the attack. The vendor has not responded to disclosure attempts, leaving users without an official patch. | MEDIUM | 5.5 | 1.0% | 49 |
PoC
No patch
|
| CVE-2026-14628 | Path traversal in NousResearch hermes-agent (all versions through 2026.5.16) exposes arbitrary server-side files via the Live Webhook Endpoint's `extract_media` function in `gateway/platforms/base.py`. Remote, unauthenticated attackers can read files outside the intended directory, resulting in low-confidentiality-impact disclosure - potentially exposing configuration files, credentials, or internal data. A public proof-of-concept exploit is available on GitHub; however, this vulnerability has not been listed in CISA KEV, indicating active exploitation is not yet confirmed at time of analysis. | MEDIUM | 5.5 | 0.6% | 48 |
PoC
No patch
|
| CVE-2026-9351 | Path traversal in NousResearch hermes-agent through version 2026.4.16 allows remote unauthenticated attackers to bypass path restrictions and modify or disrupt file operations via the read_file tool. The flaw exists in the _is_blocked_device function within tools/file_tools.py. Public exploit code is available (EPSS data not provided, but exploit confirmed). Vendor was notified but did not respond, suggesting no official patch exists at time of analysis. | MEDIUM | 5.5 | 0.1% | 48 |
PoC
No patch
|
| CVE-2026-9368 | Remote sandbox escape in NousResearch hermes-agent versions up to 2026.4.16 allows unauthenticated attackers to manipulate environment variables through the code execution tool, potentially breaking out of the intended security sandbox. The vulnerability has publicly available exploit code and the vendor has not responded to disclosure attempts, leaving systems unpatched. | MEDIUM | 5.5 | 0.1% | 48 |
PoC
|
| CVE-2026-7396 | Path traversal in NousResearch hermes-agent 0.8.0 exposes arbitrary server-side files to unauthenticated remote attackers through the WeChat Work (WeCom) platform adapter component. The vulnerability resides in gateway/platforms/wecom.py and is limited to confidentiality impact (VC:L), with no integrity or availability consequence. A public proof-of-concept exists per GitHub issue reference, though EPSS of 0.05% (15th percentile) and SSVC's 'Automatable: no' designation indicate constrained real-world exploitation risk; no CISA KEV listing has been confirmed. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-10220 | Remote injection in NousResearch Hermes Agent through version 2026.4.30 allows unauthenticated attackers to manipulate the _serve_plugin_skill/skill_view function in tools/skills_tool.py. Publicly available exploit code exists via a GitHub gist, and the vendor has not responded to disclosure attempts, leaving deployments without an official fix. CVSS 7.3 reflects network-reachable, low-complexity exploitation with partial impact across confidentiality, integrity, and availability. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-10221 | Remote code/prompt injection in NousResearch Hermes Agent through 0.12.0 stems from improper neutralization in the _compress_context function within run_agent.py (CWE-74). Publicly available exploit code exists and the issue is remotely triggerable without authentication per the CVSS vector, though impact is bounded to Low across confidentiality, integrity, and availability. The vendor was contacted but did not respond, leaving downstream users without an official fix at time of analysis. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-9353 | Remote injection vulnerability in NousResearch hermes-agent versions up to 2026.4.23 enables unauthenticated attackers to inject malicious payloads through the Skills Guard component's multi-word prompt handling mechanism. The vulnerability has publicly available exploit code and allows attackers to achieve limited confidentiality, integrity, and availability impacts without user interaction. Despite early vendor notification, no response or patch has been provided. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
|
| CVE-2026-9354 | Improper output escaping in NousResearch Hermes Agent versions up to 2026.4.16 allows remote unauthenticated attackers to manipulate message formatting in Slack and Mattermost integrations, potentially leading to information disclosure and service disruption. The vulnerability is exploitable via crafted format_message arguments with low attack complexity and requires no user interaction. Public exploit code is available via GitHub Gist. The vendor did not respond to early disclosure attempts, and no patch availability is documented. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-9366 | Code injection in NousResearch hermes-agent 2026.4.23 allows remote unauthenticated attackers to inject and execute arbitrary code through the _scan_context_content function in agent/prompt_builder.py. The vulnerability has publicly available exploit code and affects all versions up to 2026.4.23, with the vendor failing to respond to disclosure attempts. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
|
| CVE-2026-10224 | Uncontrolled resource consumption in NousResearch hermes-agent (all versions through 2026.4.30) allows remote unauthenticated attackers to degrade service availability by sending crafted requests to the Feishu webhook endpoint. The vulnerable function `_handle_webhook_request` in `gateway/platforms/feishu.py` fails to bound resource usage during webhook processing, enabling denial-of-service conditions. A publicly available proof-of-concept exploit exists (hosted on GitHub), the vendor did not respond to responsible disclosure, and no patch has been released - leaving all deployments with active Feishu integration exposed with no official remediation path. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-9350 | Missing authorization in NousResearch hermes-agent versions up to 2026.4.16 allows remote attackers to bypass authentication checks in the Batch Runner component, potentially executing unauthorized commands. The vulnerability affects the check_all_command_guards function in tools/approval.py and can be exploited without authentication. Publicly available exploit code exists, though the vulnerability is not yet confirmed in CISA KEV. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-9352 | Information disclosure in NousResearch hermes-agent allows remote unauthenticated attackers to extract sensitive data via crafted requests to the Messaging Gateway Handler's environment configuration function. The vulnerability affects versions up to 2026.4.23 with publicly available exploit code demonstrating the attack. EPSS data not provided, but public POC availability increases immediate risk. Vendor has not responded to disclosure, suggesting no official patch timeline. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-82021 | Supply-chain remote code execution affects NousResearch Hermes Agent versions 0.18.2 through 0.18.x (prior to 0.19.0), where the bundled MCP catalog references a third-party upstream repository via a mutable git branch instead of a pinned commit SHA. An attacker who compromises that upstream repository can push malicious code that is automatically pulled onto every host installing the affected catalog entry, achieving code execution with no further operator action. Reported by VulnCheck; a vendor patch exists (v0.19.0) but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.0 | 0.2% | 45 |
|