CVE-2026-14626

A weakness has been identified in NousResearch hermes-agent up to 2026.4.30. The impacted element is the function AIAgent.run_conversation of the file run_agent.py of the component HTTP API. This manipulation of the argument todos causes denial of service. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-404

• https://gist.github.com/YLChen-007/b91a85f9448beadebe25d37a3f4fd760
• https://vuldb.com/cve/CVE-2026-14626
• https://vuldb.com/submit/845596
• https://vuldb.com/vuln/376142
• https://vuldb.com/vuln/376142/cti

Published

Jul 4, 2026

Last Modified

Jul 7, 2026

Status

Deferred

• CVE-2026-14620webpack-dev-server versions 5.2.5 and earlier expose two int…4.7
• CVE-2026-14621A vulnerability has been found in FederatedAI FATE up to 2.2…3.1
• CVE-2026-14622A vulnerability was found in jairiidriss restaurant-website-…7.3
• CVE-2026-14623A vulnerability was determined in omec-project amf up to 2.1…4.3
• CVE-2026-14624A vulnerability was identified in omec-project amf up to 2.0…4.3
• CVE-2026-14625A security flaw has been discovered in NousResearch hermes-a…6.3
• CVE-2026-14627A security vulnerability has been detected in NousResearch h…5.6
• CVE-2026-14628A vulnerability was detected in NousResearch hermes-agent up…5.5
• CVE-2026-14629A flaw has been found in RT-Thread up to 5.2.2. Affected is …4.3
• CVE-2026-1463The Photo Gallery, Sliders, Proofing and Themes – NextGEN Ga…8.8
• CVE-2026-14630A vulnerability has been found in ForceInjection AI-funderme…3.1
• CVE-2026-14631webpack-dev-server versions 5.2.5 and earlier terminate the …5.3