CVE-2026-18773

A vulnerability was detected in NousResearch hermes-agent up to 2026.6.5. Affected by this issue is the function _check_slash_access of the file gateway/run.py of the component Quick Command Handler. The manipulation results in incorrect authorization. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-285
• CWE-863

• https://gist.github.com/YLChen-007/f0036aa1c410b70f5e41272947180645
• https://vuldb.com/cve/CVE-2026-18773
• https://vuldb.com/submit/856874
• https://vuldb.com/vuln/385783
• https://vuldb.com/vuln/385783/cti

Published

Aug 4, 2026

Last Modified

Aug 12, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18765Improper neutralization of special elements used in an SQL c…9.8
• CVE-2026-18766A flaw has been found in chetans9 core-php-admin-panel up to…6.3
• CVE-2026-1877The Auto Post Scheduler plugin for WordPress is vulnerable t…6.1
• CVE-2026-18770A vulnerability has been found in vibesurf-ai VibeSurf up to…7.3
• CVE-2026-18771Missing authentication for critical function vulnerability i…7.5
• CVE-2026-18772Improperly controlled sequential memory allocation vulnerabi…6.5
• CVE-2026-18774A flaw has been found in NousResearch hermes-agent up to 0.1…6.3
• CVE-2026-18775A vulnerability has been found in NousResearch hermes-agent …6.3
• CVE-2026-18776The TrueBooker WordPress plugin before 1.2.7 does not have …9.8
• CVE-2026-18777The TrueBooker WordPress plugin before 1.2.7 does not have …5.3
• CVE-2026-18778The TrueBooker WordPress plugin before 1.2.7 does not have …5.3
• CVE-2026-18779The TrueBooker WordPress plugin before 1.2.7 does not have …5.3