CVE-2026-9369

A security flaw has been discovered in NousResearch hermes-agent 2026.4.23. Affected is the function _discover_dashboard_plugins of the file hermes_cli/web_server.py of the component CLI web-dashboard Interface. Performing a manipulation of the argument HERMES_ENABLE_PROJECT_PLUGINS results in incorrect comparison. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-697

• https://gist.github.com/YLChen-007/062b77ceac6aa9844842a616f5d2ef30
• https://vuldb.com/submit/812230
• https://vuldb.com/vuln/365332
• https://vuldb.com/vuln/365332/cti

Published

May 24, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9368A vulnerability was identified in NousResearch hermes-agent …7.3
• CVE-2026-93682When the HTTP stream wrapper follows a redirect and the resp…5.8
• CVE-2026-93685A flaw was found in the multicluster-observability-addon. A …5.4
• CVE-2026-93687braces through 3.0.3 contains a stack overflow vulnerability…7.5
• CVE-2026-93688SGLang through 0.5.19 in prefill/decode disaggregation mode …7.5
• CVE-2026-93689WinFsp through 2.2.26215 contains a null pointer dereference…5.5
• CVE-2026-93690uri-js through 4.4.1 contains a denial of service vulnerabil…7.5
• CVE-2026-9370A weakness has been identified in ulisesbocchio jasypt-sprin…3.7
• CVE-2026-93709Dancer2 versions before 2.2.0 for Perl serve a layout as a p…5.3
• CVE-2026-9371A security vulnerability has been detected in ItzCrazyKns Va…5.6
• CVE-2026-93710Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a…7.5
• CVE-2026-93711Dancer2 versions before 2.2.0 for Perl do not strip CR and L…6.5