CVE-2026-84287: Improper Resource Shutdown or Release

A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is some unknown functionality of the file gateway/platforms/apiserver.py of the component Session Chat Interface. This manipulation causes denial of service. The attack is possible to be carried out remotely. The...

CVE-2026-15311: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in NousResearch hermes-agent up to 2026.5.29.2. Affected by this issue is the function MatrixAdapter.markdowntohtml of the file gateway/platforms/matrix.py of the component Matrix Adapter. Such manipulation leads to cross site scripting. The attack can be executed...

PT-2026-57019

A vulnerability was identified in NousResearch hermes-agent up to 2026.5.29.2. Affected by this issue is the function MatrixAdapter. markdown to html of the file gateway/platforms/matrix.py of the component Matrix Adapter. Such manipulation leads to cross site scripting. The attack can be execute...

CVE-2026-14628

A vulnerability was detected in NousResearch hermes-agent up to 2026.5.16. This impacts the function extractmedia of the file gateway/platforms/base.py of the component Live Webhook Endpoint. Performing a manipulation results in path traversal. The attack may be initiated remotely. The exploit is...

CVE-2026-14628 NousResearch hermes-agent Live Webhook Endpoint base.py extract_media path traversal

A vulnerability was detected in NousResearch hermes-agent up to 2026.5.16. This impacts the function extractmedia of the file gateway/platforms/base.py of the component Live Webhook Endpoint. Performing a manipulation results in path traversal. The attack may be initiated remotely. The exploit is...

CVE-2026-14627

The vulnerability CVE-2026-14627 affects NousResearch hermes-agent up to 0.15.2, specifically the Discord Platform Integration’s DiscordAdapter._is_allowed_user in gateway/platforms/discord.py. The root cause is improper authentication caused by manipulation of this function, enabling a remote at...

hermes-agent has an Uncontrolled Resource Consumption issue

A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. This vulnerability affects the function handlewebhookrequest of the file gateway/platforms/feishu.py of the component Webhook Endpoint. Such manipulation leads to resource consumption. The attack can be...

CVE-2026-10224: Uncontrolled Resource Consumption

A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. This vulnerability affects the function handlewebhookrequest of the file gateway/platforms/feishu.py of the component Webhook Endpoint. Such manipulation leads to resource consumption. The attack can be...

PT-2026-65660

A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. This vulnerability affects the function handle webhook request of the file gateway/platforms/feishu.py of the component Webhook Endpoint. Such manipulation leads to resource consumption. The attack can be...

CVE-2026-7396: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was identified in NousResearch hermes-agent 0.8.0. Affected by this issue is some unknown functionality of the file gateway/platforms/wecom.py of the component WeChat Work Platform Adapter. The manipulation leads to path traversal. It is possible to initiate the attack remotely. T...

CVE-2026-7112: Improper Authentication

A vulnerability has been found in NousResearch hermes-agent 0.8.0. Affected by this vulnerability is the function checkauth of the file gateway/platforms/apiserver.py of the component APISERVERKEY Handler. The manipulation leads to improper authentication. The attack can be initiated remotely. Th...

CVE-2026-7113: Missing Authentication for Critical Function

A vulnerability was found in NousResearch hermes-agent 0.8.0. Affected by this issue is some unknown functionality of the file gateway/platforms/webhook.py of the component Webhooks Endpoint. The manipulation of the argument INSECURENOAUTH results in missing authentication. The attack can be...

io.apiman:apiman-gateway-platforms-undertow (>=1.1.0.rc3, <=1.2.1.final), io.undertow.jastow:jastow (>=1.0.1.final, <=1.0.3.final) +3 more potentially affected by CVE-2026-3260 via io.undertow:undertow-core (1.0.1.final)

io.undertow:undertow-core MAVEN version 1.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.apiman:apiman-gateway-platforms-undertow =1.1.0.rc3, =1.0.1.final, =3.0.7.final, =3.0.12.final Sourc...

io.apiman:apiman-gateway-platforms-undertow (>=1.1.0.rc3, <=1.2.1.final), io.undertow.jastow:jastow (>=1.0.1.final, <=1.0.3.final) +3 more potentially affected by CVE-2024-4027 via io.undertow:undertow-core (1.0.1.final)

io.undertow:undertow-core MAVEN version 1.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.apiman:apiman-gateway-platforms-undertow =1.1.0.rc3, =1.0.1.final, =3.0.7.final, =3.0.12.final Sourc...

io.apiman:apiman-gateway-platforms-undertow (>=1.1.0.rc3, <=1.2.1.final), io.undertow.jastow:jastow (>=1.0.1.final, <=1.0.3.final) +3 more potentially affected by CVE-2025-12543 via io.undertow:undertow-core (1.0.1.final)

io.undertow:undertow-core MAVEN version 1.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.apiman:apiman-gateway-platforms-undertow =1.1.0.rc3, =1.0.1.final, =3.0.7.final, =3.0.12.final Sourc...

io.apiman:apiman-distro-vertx (>=1.3.0.final, <=1.3.1.final), io.apiman:apiman-gateway-platforms-vertx3 (>=1.3.0.final, <=1.3.1.final) +37 more potentially affected by CVE-2025-11966 via io.vertx:vertx-web (3.4.0)

io.vertx:vertx-web MAVEN version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-web and may be impacted: - io.apiman:apiman-distro-vertx =1.3.0.final, =1.3.0.final, =1.3.0.final, =1.3.1.final -...

io.apiman:apiman-distro-vertx (>=2.1.4.final, <=2.1.5.final), io.apiman:apiman-gateway-platforms-vertx3 (>=2.1.4.final, <=2.1.5.final) +53 more potentially affected by CVE-2025-11966 via io.vertx:vertx-web (3.9.11)

io.vertx:vertx-web MAVEN version 3.9.11 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-web and may be impacted: - io.apiman:apiman-distro-vertx =2.1.4.final, =2.1.4.final, =2.1.4.final, =1.3.10, =1.3.7, =1.3.7, =1.3.11 and more Source...

io.apiman:apiman-distro-vertx (>=1.3.0.final, <=1.3.1.final), io.apiman:apiman-gateway-platforms-vertx3 (>=1.3.0.final, <=1.3.1.final) +37 more potentially affected by CVE-2025-11965 via io.vertx:vertx-web (3.4.0)

io.vertx:vertx-web MAVEN version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-web and may be impacted: - io.apiman:apiman-distro-vertx =1.3.0.final, =1.3.0.final, =1.3.0.final, =1.3.1.final -...

io.apiman:apiman-distro-vertx (>=2.1.4.final, <=2.1.5.final), io.apiman:apiman-gateway-platforms-vertx3 (>=2.1.4.final, <=2.1.5.final) +53 more potentially affected by CVE-2025-11965 via io.vertx:vertx-web (3.9.11)

io.vertx:vertx-web MAVEN version 3.9.11 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-web and may be impacted: - io.apiman:apiman-distro-vertx =2.1.4.final, =2.1.4.final, =2.1.4.final, =1.3.10, =1.3.7, =1.3.7, =1.3.11 and more Source...

io.apiman:apiman-gateway-platforms-undertow (>=1.1.0.rc3, <=1.2.1.final), io.undertow.jastow:jastow (>=1.0.1.final, <=1.0.3.final) +3 more potentially affected by CVE-2022-4492 via io.undertow:undertow-core (1.0.1.final)

io.undertow:undertow-core MAVEN version 1.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.apiman:apiman-gateway-platforms-undertow =1.1.0.rc3, =1.0.1.final, =3.0.7.final, =3.0.12.final Sourc...