CVE-2026-53871

Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the getprofilecookie function that accepts unauthenticated profile names from the hermesprofile cookie. An authenticated attacker can forge the hermesprofile cookie value to bypass profile-scoped authorization checks a...

CVE-2026-55198

Hermes WebUI prior to 0.51.443 contains an authorization bypass in the session export endpoint. The _handle_session_export handler in api/routes.py fails to verify active-profile ownership before serializing session data, allowing authenticated users to exfiltrate transcripts from other profiles ...

CVE-2026-53871

Hermes WebUI prior to version 0.51.368 contains an authorization bypass in get_profile_cookie() that accepts unauthenticated profile names via the hermes_profile cookie. An authenticated attacker can forge the hermes_profile cookie to bypass profile-scoped authorization and access sessions, files...

Exploit for CVE-2026-48907

CVE-2026-48907 CVE-2026-48907 is a critical improper acc...

CVE-2026-12442

creationtimestamp| type| source ---|---|--- 2026-06-17 01:56:44+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-google-chrome-56 2026-06-17 04:30:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mohi4jqflv2o 2026-06-17 05:03:16+00:00| seen|...

PT-2026-50523

Name of the Vulnerable Software and Affected Versions Hermes WebUI versions prior to 0.51.443 Description An authorization bypass exists in the session export endpoint, allowing authenticated users to access sessions belonging to other profiles. The handle session export function in 'api/routes.p...

CVE-2026-53853

creationtimestamp| type| source ---|---|--- 2026-06-16 21:01:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mogozvim4327 2026-06-16 21:21:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mogq63qo3o2j 2026-06-19 08:11:42+00:00| seen|...

CVE-2026-53776

creationtimestamp| type| source ---|---|--- 2026-06-16 17:21:17+00:00| seen| https://bsky.app/profile/securitycyberuk.bsky.social/post/3mogcpum37t2k 2026-06-16 17:58:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mogert55pv2f 2026-06-16 18:00:45+00:00| seen|...

CVE-2026-5416

creationtimestamp| type| source ---|---|--- 2026-06-16 08:18:30+00:00| seen| https://bsky.app/profile/certvde.infosec.exchange.ap.brid.gy/post/3mofeee5snmy2 2026-06-16 11:00:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mofnhp7x6t2n 2026-06-16 13:42:38+00:00| seen|...

CVE-2026-6933

creationtimestamp| type| source ---|---|--- 2026-06-16 07:00:05+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mof7z2bjzc2n 2026-06-16 09:23:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mofhyli5x32c 2026-06-16 12:05:58+00:00| seen|...

Widget Factory Joomla Content Editor Improper Access Control Vulnerability

Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users...

CVE-2026-12214

creationtimestamp| type| source ---|---|--- 2026-06-15 05:00:12+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mocitrj45z2v 2026-06-15 06:00:27+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mocm7jz4ix2a 2026-06-15 06:00:33+00:00| seen|...

CVE-2026-54410

creationtimestamp| type| source ---|---|--- 2026-06-14 19:00:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mobhcwfd6s2w 2026-06-14 20:02:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mobkt6lb7w2r...

CVE-2026-11624

creationtimestamp| type| source ---|---|--- 2026-06-13 10:32:12+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mo62ehueb527 2026-06-13 11:27:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo65jxsbas2z 2026-06-17 14:37:00+00:00| seen|...

CVE-2026-9109

creationtimestamp| type| source ---|---|--- 2026-06-13 09:00:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/116741978443656575 2026-06-13 09:01:21+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mo5vdj745l2x 2026-06-13 09:44:36+00:00| seen|...

CVE-2026-53521

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to before version 2.1.0, PATCH /server/id accepts and persists nonexistent ddnsprofiles IDs for a member-owned server. If another user later creates a DDNS profile with one of those...

CVE-2026-9266

creationtimestamp| type| source ---|---|--- 2026-06-12 07:09:11+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/control-systems-moxa-security-advisory-av26-594 2026-06-12 13:00:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mo3sb5ojvv2o 2026-06-12 13:47:00+00:00| seen|...

CVE-2026-47369

creationtimestamp| type| source ---|---|--- 2026-06-12 05:22:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo2yohqgv22p 2026-06-12 06:01:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mo32tq5wkr2p 2026-06-12 19:13:13+00:00| seen|...

CVE-2026-48611

creationtimestamp| type| source ---|---|--- 2026-06-12 05:00:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mo2xhfwjef24 2026-06-12 05:36:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo2zi7lj7g2b 2026-06-12 18:51:21+00:00| seen|...

CVE-2026-44249

creationtimestamp| type| source ---|---|--- 2026-06-12 01:00:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mo2k2h43or2t 2026-06-12 01:44:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo2mj5sag22j 2026-06-15 04:37:06+00:00| seen|...