hermes-agent has 10 CVEs on record. Disclosures have slowed: 0 in the last 90 days after 10 in the 90 before. The busiest recent month was June 2026 with 6. The median CVSS is 6.8 (medium). None have a confirmed exploitation report.

CVEs per month

Last 12 months, by publish date

1025/101125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/09

Exploited share: 0% vs 1% corpus
Median CVSS: 6.8
Publish → KEV: —
Last 90 days: 0 prev 10

Weakness classes

Products

hermes-agent 10

Follow hermes-agent:RSS feed Save a search →Embed badge ↗

Total CVEs

Critical

CISA KEV

Exploited

Worst active — by depth score

hermes-agent vulnerabilities

CVEs affecting hermes-agent, newest first. Open any entry for full detail, references, and exploit status.

10 CVEsRSS

CVE-2026-53870Medium· 5.5

3mo ago

Hermes Agent creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644)

▾ Sunlithermes-agent · hermes-agentEPSS 0.11%via GHSA

CVE-2026-53869High· 7.5

3mo ago

Hermes Agent contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation

▾ Twilighthermes-agent · hermes-agentEPSS 0.59%via GHSA

CVE-2026-10224Medium· 5.3

3mo ago

CVEs per month

Weakness classes

Products

Worst active — by depth score

hermes-agent vulnerabilities

Hermes Agent creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644)

Hermes Agent contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation

hermes-agent has an Uncontrolled Resource Consumption issue

hermes-agent has an Injection issue

hermes-agent has an Injection issue

hermes-agent has an Injection issue

hermes-agent has a sandbox issue

hermes-agent has an Injection issue

hermes-agent has an Incorrect Comparison

hermes-agent has an Injection issue