Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

NousResearch — Vulnerabilities & Security Advisories 44

Browse all 44 CVE security advisories affecting NousResearch. AI-powered Chinese analysis, POCs, and references for each vulnerability.

NousResearch develops AI research tools and platforms, focusing on advanced machine learning and data analysis solutions. Historically, their systems have been susceptible to remote code execution (RCE) and cross-site scripting (XSS) vulnerabilities, often stemming from improper input validation and insecure API endpoints. While no major public security incidents have been documented, the organization maintains a moderate vulnerability profile with four CVEs recorded to date. Their security posture appears typical for AI research platforms, balancing functionality with basic security measures. The company's codebase and infrastructure remain subject to standard web application risks, though no systemic weaknesses or high-impact breaches have been reported in their public-facing services.

Top products by NousResearch: hermes-agent
CVE ID Title CVSS Severity Published
CVE-2026-71963 Hermes Agent 0.18.2 - 0.21.0 RCE via git core.fsmonitor Config Injection — hermes-agent CWE-78 8.8 High 2026-09-03
CVE-2026-85107 NousResearch hermes-agent Electron Main Process main.ts resourceBufferFromUrl allocation of resources — hermes-agent CWE-770 4.3 Medium 2026-09-03
CVE-2026-85106 NousResearch hermes-agent Link Title Fetch index.tsx fetchLinkTitle server-side request forgery — hermes-agent CWE-918 6.3 Medium 2026-09-03
CVE-2026-85105 NousResearch hermes-agent Session Management s71.py _sess_nowait authorization — hermes-agent CWE-639 7.3 High 2026-09-03
CVE-2026-84289 NousResearch hermes-agent MCP Tool mcp_tool.py list_tools memory allocation — hermes-agent CWE-789 4.3 Medium 2026-09-01
CVE-2026-84288 NousResearch hermes-agent ACP Prompt Workflow session.py HermesACPAgent.prompt denial of service — hermes-agent CWE-404 4.3 Medium 2026-09-01
CVE-2026-84287 NousResearch hermes-agent Session Chat api_server.py denial of service — hermes-agent CWE-404 4.3 Medium 2026-09-01
CVE-2026-82021 Hermes Agent 0.18.2 < 0.19.0 MCP Catalog Supply Chain RCE via Mutable Branch Reference — hermes-agent CWE-494 8.3 High 2026-08-28
CVE-2026-82020 Hermes Agent 0.16.0 < 0.17.0 Credential Store Overwrite via File-Write Tool — hermes-agent CWE-552 6.8 Medium 2026-08-28
CVE-2026-18993 NousResearch hermes-agent Memory Toolset model_tools.py access control — hermes-agent CWE-284 6.3 Medium 2026-08-06
CVE-2026-18976 NousResearch hermes-agent disabled_toolsets agent_init.py get_tool_definitions privileges assignment — hermes-agent CWE-266 6.3 Medium 2026-08-06
CVE-2026-18775 NousResearch hermes-agent Browser Tooling browser_tool.py browser_snapshot server-side request forgery — hermes-agent CWE-918 6.3 Medium 2026-08-04
CVE-2026-18774 NousResearch hermes-agent xAI Image Generation Provider image_gen_provider.py save_url_image server-side request forgery — hermes-agent CWE-918 6.3 Medium 2026-08-04
CVE-2026-18773 NousResearch hermes-agent Quick run.py _check_slash_access authorization — hermes-agent CWE-863 6.3 Medium 2026-08-04
CVE-2026-17432 NousResearch hermes-agent SimpleX Gateway Authorization adapter.py access control — hermes-agent CWE-284 5.0 Medium 2026-07-26
CVE-2026-15311 NousResearch hermes-agent Matrix Adapter matrix.py MatrixAdapter._markdown_to_html cross site scripting — hermes-agent CWE-79 3.5 Low 2026-07-09
CVE-2026-14783 NousResearch hermes-agent skills_tool.py skill_view path traversal — hermes-agent CWE-22 4.3 Medium 2026-07-05
CVE-2026-14628 NousResearch hermes-agent Live Webhook Endpoint base.py extract_media path traversal — hermes-agent CWE-22 5.3 Medium 2026-07-04
CVE-2026-14627 NousResearch hermes-agent Discord Platform Integration discord.py DiscordAdapter._is_allowed_user improper authentication — hermes-agent CWE-287 5.6 Medium 2026-07-04
CVE-2026-14626 NousResearch hermes-agent HTTP API run_agent.py AIAgent.run_conversation denial of service — hermes-agent CWE-404 4.3 Medium 2026-07-04
CVE-2026-14625 NousResearch hermes-agent server.py shell.exec protection mechanism — hermes-agent CWE-693 6.3 Medium 2026-07-04
CVE-2026-14617 NousResearch hermes-agent Streaming Reasoning Tag Filter stream_consumer.py GatewayStreamConsumer._filter_and_accumulate case sensitivity — hermes-agent CWE-178 3.1 Low 2026-07-03
CVE-2026-53870 Hermes Agent < 0.16.0 - Sensitive File Permission Vulnerability in Store Files — hermes-agent CWE-276 5.5 Medium 2026-06-17
CVE-2026-53869 Hermes Agent < 0.16.0 - DNS Rebinding Bypass via WebSocket Endpoints — hermes-agent CWE-306 7.5 High 2026-06-17
CVE-2026-11461 NousResearch hermes-agent resume Endpoint hermes_state.py resolve_session_by_title authorization — hermes-agent CWE-639 6.3 Medium 2026-06-07
CVE-2026-10548 NousResearch hermes-agent Credential Pool Synchronization credential_pool.py _sync_anthropic_entry_from_credentials_file improper authentication — hermes-agent CWE-287 5.3 Medium 2026-06-02
CVE-2026-10224 NousResearch hermes-agent Webhook Endpoint feishu.py _handle_webhook_request resource consumption — hermes-agent CWE-400 5.3 Medium 2026-06-01
CVE-2026-10223 NousResearch hermes-agent memory_tool.py _scan_memory_content injection — hermes-agent CWE-74 6.3 Medium 2026-06-01
CVE-2026-10222 NousResearch hermes-agent config.py _sanitize_env_lines injection — hermes-agent CWE-74 5.6 Medium 2026-06-01
CVE-2026-10221 NousResearch hermes-agent run_agent.py _compress_context injection — hermes-agent CWE-74 7.3 High 2026-06-01

This page lists every published CVE security advisory associated with NousResearch. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.