Nousresearch vulnerabilities
44 CVEs and advisories name Nousresearch as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-71963Hermes Agent 0.18.2 - 0.21.0 RCE via git core.fsmonitor Config Injection
- CVE-2026-85107NousResearch hermes-agent Electron Main Process main.ts resourceBufferFromUrl allocation of resources
- CVE-2026-85106NousResearch hermes-agent Link Title Fetch index.tsx fetchLinkTitle server-side request forgery
- CVE-2026-85105NousResearch hermes-agent Session Management s71.py _sess_nowait authorization
- CVE-2026-84289NousResearch hermes-agent MCP Tool mcp_tool.py list_tools memory allocation
- CVE-2026-84288NousResearch hermes-agent ACP Prompt Workflow session.py HermesACPAgent.prompt denial of service
- CVE-2026-84287NousResearch hermes-agent Session Chat api_server.py denial of service
- CVE-2026-82021Hermes Agent 0.18.2 < 0.19.0 MCP Catalog Supply Chain RCE via Mutable Branch Reference
- CVE-2026-82020Hermes Agent 0.16.0 < 0.17.0 Credential Store Overwrite via File-Write Tool
- CVE-2026-18993NousResearch hermes-agent Memory Toolset model_tools.py access control
- CVE-2026-18976NousResearch hermes-agent disabled_toolsets agent_init.py get_tool_definitions privileges assignment
- CVE-2026-18775NousResearch hermes-agent Browser Tooling browser_tool.py browser_snapshot server-side request forgery
- CVE-2026-18774NousResearch hermes-agent xAI Image Generation Provider image_gen_provider.py save_url_image server-side request forgery
- CVE-2026-18773NousResearch hermes-agent Quick run.py _check_slash_access authorization
- CVE-2026-17432NousResearch hermes-agent SimpleX Gateway Authorization adapter.py access control
- CVE-2026-15311NousResearch hermes-agent Matrix Adapter matrix.py MatrixAdapter._markdown_to_html cross site scripting
- CVE-2026-14783NousResearch hermes-agent skills_tool.py skill_view path traversal
- CVE-2026-14628NousResearch hermes-agent Live Webhook Endpoint base.py extract_media path traversal
- CVE-2026-14627NousResearch hermes-agent Discord Platform Integration discord.py DiscordAdapter._is_allowed_user improper authentication
- CVE-2026-14626NousResearch hermes-agent HTTP API run_agent.py AIAgent.run_conversation denial of service
- CVE-2026-14625NousResearch hermes-agent server.py shell.exec protection mechanism
- CVE-2026-14617NousResearch hermes-agent Streaming Reasoning Tag Filter stream_consumer.py GatewayStreamConsumer._filter_and_accumulate case sensitivity
- CVE-2026-53870Hermes Agent < 0.16.0 - Sensitive File Permission Vulnerability in Store Files
- CVE-2026-53869Hermes Agent < 0.16.0 - DNS Rebinding Bypass via WebSocket Endpoints
- CVE-2026-11461NousResearch hermes-agent resume Endpoint hermes_state.py resolve_session_by_title authorization
- CVE-2026-10548NousResearch hermes-agent Credential Pool Synchronization credential_pool.py _sync_anthropic_entry_from_credentials_file improper authentication
- CVE-2026-10224NousResearch hermes-agent Webhook Endpoint feishu.py _handle_webhook_request resource consumption
- CVE-2026-10223NousResearch hermes-agent memory_tool.py _scan_memory_content injection
- CVE-2026-10222NousResearch hermes-agent config.py _sanitize_env_lines injection
- CVE-2026-10221NousResearch hermes-agent run_agent.py _compress_context injection