These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-58123 is a critical unauthenticated remote code execution vulnerability in Hermes WebUI versions before 0.51.788. The vulnerability allows remote attackers to execute arbitrary shell commands by accessing the embedded terminal API endpoints without credentials. This is achieved through four sequential unauthenticated HTTP requests to create a session, attach a PTY shell, and write arbitrary comma [truncated]
CVE-2026-55205 is a resource exhaustion vulnerability in Hermes WebUI before version 0.51.468. The vulnerability is located in the unauthenticated POST /api/onboarding/oauth/start endpoint, which allows for unbounded accumulation of in-memory flow state and daemon threads. This can be exploited by sending repeated or concurrent requests to exhaust server memory and thread resources, potentially triggering [truncated]
CVE-2026-55198 is an authorization bypass vulnerability in Hermes WebUI before 0.51.443. The vulnerability allows authenticated users to access sessions from other profiles via the session export endpoint. Defenders should assess exposure and prioritize upgrading to version 0.51.443 or later. The _handle_session_export handler in api/routes.py fails to verify active-profile ownership before serializing se [truncated]
CVE-2026-55197 debrief based on the supplied source corpus. The CVE record was published on 2026-06-17T19:18:13.340Z and has not been modified since then. The vulnerability affects Hermes WebUI before version 0.51.443, allowing authenticated users to disclose cross-profile session transcripts via the /api/session endpoint. This broken access control vulnerability enables attackers to bypass profile bounda [truncated]
A critical vulnerability, CVE-2026-55196, has been discovered in Hermes WebUI, a web-based user interface for Hermes. The vulnerability is an authentication bypass issue that allows unauthenticated remote attackers to register arbitrary passkeys. When the HERMES_WEBUI_PASSKEY=1 configuration is enabled with no existing credentials, the POST /api/auth/passkey/register/options and POST /api/auth/passkey/reg [truncated]
CVE-2026-53871 is an authorization bypass vulnerability in Hermes WebUI before version 0.51.368. The vulnerability is due to the get_profile_cookie() function accepting unauthenticated profile names from the hermes_profile cookie, allowing an authenticated attacker to forge the hermes_profile cookie value and bypass profile-scoped authorization checks.
CVE-2026-49973 is a critical vulnerability in Hermes WebUI before version 0.51.358. It allows unauthenticated remote attackers to hijack initial setup by submitting the _set_password parameter to the settings API endpoint without any network origin restriction. Attackers on any reachable network can send a POST request to the settings endpoint during the first-run setup window to persist an arbitrary pass [truncated]
CVE-2026-49959 is a high-severity remote code execution vulnerability in Hermes WebUI versions before 0.51.311. Authenticated attackers can exploit this via Git configuration injection to execute arbitrary commands on the host running the application. The vulnerability is caused by the application's use of Git subprocess invocations in api/workspace_git.py, which can be exploited through various vectors s [truncated]
CVE-2026-49957 is a MEDIUM severity vulnerability in Hermes WebUI prior to version 0.51.296. Authenticated attackers can bypass blocked-root path checks, read access to local system files through workspace file-read helpers.
CVE-2026-11322 is a path traversal vulnerability in Hermes WebUI prior to v0.51.221. This vulnerability allows attackers to escape the workspace boundary by supplying symlinks that resolve to files or directories outside the designated workspace root. Attackers can exploit the workspace file and listing APIs, which resolve symlink targets without enforcing that the final path remains within the workspace, [truncated]
Hermes WebUI versions prior to 0.51.44 contain a path traversal vulnerability in the session import endpoint. An authenticated attacker can exploit this by importing a crafted session with a malicious workspace value that bypasses filesystem root restrictions, then using relative paths in subsequent session file API calls to read arbitrary files accessible to the WebUI process. The vulnerability stems fro [truncated]
CVE-2026-6832 is a HIGH severity vulnerability in Hermes WebUI, with a CVSS score of 7.2. The vulnerability exists in the /api/session/delete endpoint, where authenticated attackers can delete files outside the session directory by supplying an absolute path or path traversal payload in the session_id parameter. This is possible due to unvalidated session identifiers that allow attackers to construct path [truncated]
