CVE-2026-48821

creationtimestamp| type| source ---|---|--- 2026-06-17 22:44:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mojfbmjhcl22...

CVE-2026-53805

creationtimestamp| type| source ---|---|--- 2026-06-17 21:57:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mojcnac43b2v 2026-06-18 07:30:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mokcncgamb2g 2026-07-16 19:00:08+00:00| seen|...

CVE-2026-53869

creationtimestamp| type| source ---|---|--- 2026-06-17 21:52:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mojcebozjs2z...

CVE-2025-36220

creationtimestamp| type| source ---|---|--- 2026-06-17 21:15:25+00:00| seen| https://bsky.app/profile/securitycyberuk.bsky.social/post/3mojabhsgt52t 2026-08-15 02:34:07+00:00| seen| https://bsky.app/profile/vulny-app.bsky.social/post/3mt3n4kw7zd26...

CVE-2026-55197

Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session endpoint that allows authenticated users to disclose cross-profile session transcripts. Attackers can bypass profile boundary checks by directly querying session IDs belonging to other profiles via GET...

CVE-2026-53871

Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the getprofilecookie function that accepts unauthenticated profile names from the hermesprofile cookie. An authenticated attacker can forge the hermesprofile cookie value to bypass profile-scoped authorization checks a...

GHSA-4MPJ-78P6-RJ59 Duplicate Advisory: PickleScan's profile.run blocklist mismatch allows exec() bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7wx9-6375-f5wh. This link is maintained to preserve external references. Original Description picklescan before 1.0.4 contains an incomplete blocklist for the profile module that fails to block the module-level...

EUVD-2026-37608

Unauthenticated Cross Site Scripting XSS in Profile Builder Pro = 3.15.0 versions...

CVE-2026-12515

creationtimestamp| type| source ---|---|--- 2026-06-17 18:31:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moix4m6zw52r...

CVE-2026-54808

creationtimestamp| type| source ---|---|--- 2026-06-17 18:09:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moivvl4wvi2f 2026-06-18 09:06:44+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mokhzerxt623 2026-06-29 06:16:07+00:00| seen|...

CVE-2026-55198 Hermes WebUI < 0.51.443 - Cross-Profile Session Data Exfiltration via Session Export Endpoint

Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export endpoint that allows authenticated users to access sessions from other profiles. The handlesessionexport handler in api/routes.py fails to verify active-profile ownership before serializing session...

CVE-2026-55198 Hermes WebUI < 0.51.443 - Cross-Profile Session Data Exfiltration via Session Export Endpoint

Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export endpoint that allows authenticated users to access sessions from other profiles. The handlesessionexport handler in api/routes.py fails to verify active-profile ownership before serializing session...

CVE-2026-55197 Hermes WebUI < 0.51.443 - Broken Access Control in /api/session Endpoint

Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session endpoint that allows authenticated users to disclose cross-profile session transcripts. Attackers can bypass profile boundary checks by directly querying session IDs belonging to other profiles via GET...

CVE-2026-55197

Hermes WebUI before 0.51.443 has a broken access control weakness in the /api/session endpoint. Authenticated users can bypass profile boundaries and query session IDs from other profiles via GET /api/session?session_id=&messages=1 to retrieve unauthorized transcripts and metadata. This affects t...

CVE-2026-55197 Hermes WebUI < 0.51.443 - Broken Access Control in /api/session Endpoint

Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session endpoint that allows authenticated users to disclose cross-profile session transcripts. Attackers can bypass profile boundary checks by directly querying session IDs belonging to other profiles via GET...

CVE-2026-53871

Hermes WebUI prior to version 0.51.368 contains an authorization bypass in get_profile_cookie() that accepts unauthenticated profile names via the hermes_profile cookie. An authenticated attacker can forge the hermes_profile cookie to bypass profile-scoped authorization and access sessions, files...

CVE-2026-53871 Hermes WebUI < 0.51.368 - Profile-Scoped Authorization Bypass via Forged hermes_profile Cookie

Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the getprofilecookie function that accepts unauthenticated profile names from the hermesprofile cookie. An authenticated attacker can forge the hermesprofile cookie value to bypass profile-scoped authorization checks a...

CVE-2026-53871 Hermes WebUI < 0.51.368 - Profile-Scoped Authorization Bypass via Forged hermes_profile Cookie

Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the getprofilecookie function that accepts unauthenticated profile names from the hermesprofile cookie. An authenticated attacker can forge the hermesprofile cookie value to bypass profile-scoped authorization checks a...

CVE-2026-53871 Hermes WebUI < 0.51.368 - Profile-Scoped Authorization Bypass via Forged hermes_profile Cookie

Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the getprofilecookie function that accepts unauthenticated profile names from the hermesprofile cookie. An authenticated attacker can forge the hermesprofile cookie value to bypass profile-scoped authorization checks a...

CVE-2026-11311

creationtimestamp| type| source ---|---|--- 2026-06-17 17:56:04+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moiv4utt3m2c 2026-06-17 21:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1929 2026-06-25 16:45:35+00:00| seen|...