7
CVEs
1
Critical
2
High
0
KEV
3
PoC
0
Unpatched C/H
42.9%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
2
MEDIUM
2
LOW
2
Monthly CVE Trend
Affected Products (2)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-71963 | Remote code execution in NousResearch Hermes Agent 0.18.2-0.21.0 allows an unauthenticated attacker to execute arbitrary OS commands in the victim's process context by supplying a malicious git repository containing a crafted `.git/config` that sets `core.fsmonitor` to an attacker-controlled binary or script. Exploitation is triggered the moment a user opens the malicious repository and sends any message, causing the agent's internal git status call to invoke the injected command and expose the full process environment - including configured LLM provider API keys. A public exploit writeup exists (manifold.security), and a patch was released as commit f6234d0. | HIGH | 8.6 | 0.9% | 64 |
PoC
|
| CVE-2026-82021 | Supply-chain remote code execution affects NousResearch Hermes Agent versions 0.18.2 through 0.18.x (prior to 0.19.0), where the bundled MCP catalog references a third-party upstream repository via a mutable git branch instead of a pinned commit SHA. An attacker who compromises that upstream repository can push malicious code that is automatically pulled onto every host installing the affected catalog entry, achieving code execution with no further operator action. Reported by VulnCheck; a vendor patch exists (v0.19.0) but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.0 | 0.2% | 45 |
|
| CVE-2026-82020 | Credential store overwrite in NousResearch Hermes Agent versions 0.16.0 through pre-0.17.0 is achievable by any attacker who can inject content into messages ingested by the agent, exploiting a gap in the sensitive-path guard (CWE-552) that failed to properly exclude auth.json from the file-write tool's reachable paths. By crafting malicious message payloads, an attacker bypasses the path restriction and overwrites the credential store without triggering any protection, resulting in credential tampering and potential unauthorized access to all identities stored therein. No public exploit has been identified at time of analysis, and a vendor-released patch (v0.17.0) is available. | HIGH | 7.6 | 0.3% | 38 |
|
| CVE-2026-85105 | Authorization bypass in NousResearch hermes-agent 0.18.0 allows unauthenticated remote attackers to manipulate the `session_id` argument passed to the `_sess_nowait` function in `s71.py`, circumventing session-based access controls without supplying valid credentials. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivially network-reachable exploitation with no prerequisites, though impact is bounded at low across confidentiality, integrity, and availability, yielding a CVSS 4.0 score of 6.9. No vendor patch exists; NousResearch did not respond to the reporter's disclosure, and no public exploit code has been identified at time of analysis. | MEDIUM | 6.9 | 0.4% | 34 |
No patch
|
| CVE-2026-84288 | Denial of service in NousResearch hermes-agent affects the HermesACPAgent.prompt function within acp_adapter/session.py, exploitable by low-privileged remote users through the ACP Prompt Workflow interface. Versions up to and including 0.18.2 are confirmed affected, with no vendor patch issued following pre-disclosure contact. A public proof-of-concept exploit is available on GitHub, lowering the barrier to exploitation against exposed deployments. | LOW | 2.1 | 0.3% | 31 |
PoC
No patch
|
| CVE-2026-84289 | Uncontrolled memory allocation in NousResearch hermes-agent up to 0.18.2 allows a low-privileged remote attacker to exhaust memory resources by manipulating input to the list_tools function within the MCP Tool component (tools/mcp_tool.py). The vulnerability is a denial-of-service class issue (CWE-789) with low availability impact per the CVSS 4.0 vector, and a public proof-of-concept report describing resource amplification behavior has been published on GitHub. No vendor patch exists, as the vendor did not respond to coordinated disclosure. | LOW | 2.1 | 0.3% | 31 |
PoC
No patch
|
| CVE-2026-85106 | Server-side request forgery in NousResearch hermes-agent 0.18.0 allows authenticated remote attackers to issue arbitrary HTTP requests from the application server by supplying a crafted URL to the fetchLinkTitle function in the Link Title Fetch component (apps/desktop/src/app/artifacts/index.tsx). The CVSS 4.0 vector (PR:L, VC:L/VI:L/VA:L) indicates limited but real impact: an attacker with valid credentials could probe internal network services, cloud metadata endpoints, or otherwise unreachable hosts. No public exploit code and no vendor patch have been identified; the vendor did not respond to coordinated disclosure. | MEDIUM | 5.3 | 0.2% | 27 |
No patch
|