Skip to content

RadicalNotion.AI

We do not sell or share your personal information.

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Leaderboard
CNA Report Cards
Vendor Directory
Patched Functions
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0
Badge Builder

Platform

My Vulnerabilities
Insights
Notifications
Pricing

Learn

Guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About
Blog
Careers
Contact
Demo

Account

Sign up
Log in

Legal

Security
Privacy
Terms

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities and report cards
VendorsVulnerabilities by vendor
Patched FunctionsWhere CVE fixes land in code

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnSecurity guides
Data SourcesCVE data sources

About Blog Pricing Demo

Log in Create an account

Home
Patched Functions
Nesquena
Hermes Webui

nesquena/hermes-webui: Functions Patched by CVE Fixes

python

javascript

#281 of 500 repositories

nesquena/hermes-webui

Functions and files changed by CVE fixes in this repository.

Latest located fix July 9, 2026

19

CVE fixes located

Published CVEs

95

Functions patched

Distinct function sites

28

Files patched

Distinct source files

2026

Years covered

By CVE publication date

Overview

19 published CVEs have a fix traced to functions in nesquena/hermes-webui, the earliest published in 2026. Those fixes changed 95 distinct functions across 28 files, in 599 patch hunks.

Among the 500 repositories tracked here, nesquena/hermes-webui ranks #281 by the number of CVEs with a located fix.

Most patched functions

Functions in nesquena/hermes-webui changed by the most CVE fixes.

1handle_postapi/routes.py4 CVEs · 7 patches2026
2handle_getapi/routes.py4 CVEs · 7 patches2026
3_sync_session_title_to_insightsapi/routes.py3 CVEs · 6 patches2026
4_llm_update_summaryapi/routes.py2 CVEs · 6 patches2026
5_handle_session_importapi/routes.py2 CVEs · 5 patches2026
6_visible_pinned_lineage_idsapi/routes.py2 CVEs · 4 patches2026
7_handle_session_exportapi/routes.py2 CVEs · 3 patches2026
8_session_visible_to_active_profileapi/routes.py2 CVEs · 3 patches2026
9get_providersapi/providers.py2 CVEs · 3 patches2026
10_build_configured_model_badgesapi/config.py2 CVEs · 3 patches2026
11_require_passkey_registration_authapi/routes.py1 CVEs · 3 patches2026
12_handle_sessions_searchapi/routes.py1 CVEs · 3 patches2026
13_truthy_envapi/routes.py1 CVEs · 2 patches2026
14cached_update_statusapi/updates.py1 CVEs · 2 patches2026
15ok_exitdocker_init.bash1 CVEs · 2 patches2026

Most patched files

Files in nesquena/hermes-webui changed by the most CVE fixes.

1api/routes.py14 CVEs · 23 functions
2static/panels.js4 CVEs · 4 functions
3api/config.py3 CVEs · 9 functions
4api/workspace.py3 CVEs · 6 functions
5api/models.py2 CVEs · 8 functions
6api/providers.py2 CVEs · 7 functions
7api/workspace_git.py2 CVEs · 4 functions
8static/sessions.js2 CVEs · 4 functions
9server.py2 CVEs · 2 functions
10static/i18n.js2 CVEs · 0 functions

Fix size

How much code a CVE fix in nesquena/hermes-webui changes, with backports counted once.

92

Median lines changed

Added plus removed, per CVE

16%

Fixes of 20 lines or fewer

Share of CVE fixes

11%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in nesquena/hermes-webui, and the functions each fix changed.

Hermes WebUI < 0.51.307 Authentication Bypass via X-Forwarded-For Header Spoofing
CVE-2026-58122_truthy_env _sync_session_title_to_insights cached_update_status
Critical · CVSS 9.3
EPSS 0.4%2026-07-09
Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API
CVE-2026-58123_embedded_terminal_gate_allows _handle_terminal_close _handle_terminal_input
Critical · CVSS 9.3
EPSS 4.6%2026-07-09
Hermes WebUI < 0.51.521 - Cross-Profile Authorization Bypass via Unset Session Profile on Import
CVE-2026-58174_handle_session_import
Medium · CVSS 6.0
EPSS 0.5%2026-06-30
Hermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow Endpoint
CVE-2026-55205start_onboarding_oauth_flow _oauth_start_key _start_anthropic_flow
Medium · CVSS 6.9
EPSS 0.5%2026-06-18
Hermes WebUI < 0.51.443 - Cross-Profile Session Data Exfiltration via Session Export Endpoint
CVE-2026-55198_session_visible_to_active_profile _visible_pinned_lineage_ids handle_get
High · CVSS 7.1
EPSS 0.5%2026-06-17
Hermes WebUI < 0.51.443 - Broken Access Control in /api/session Endpoint
CVE-2026-55197_session_visible_to_active_profile handle_get _visible_pinned_lineage_ids
High · CVSS 7.1
EPSS 0.5%2026-06-17
Hermes WebUI < 0.51.409 - Unauthenticated Passkey Registration via Authentication Bypass
CVE-2026-55196_require_passkey_registration_auth _llm_update_summary
Critical · CVSS 9.1
EPSS 0.8%2026-06-17
Hermes WebUI < 0.51.368 - Profile-Scoped Authorization Bypass via Forged hermes_profile Cookie
CVE-2026-53871sign_profile_cookie_value _valid_profile_name build_profile_cookie
High · CVSS 8.6
EPSS 0.5%2026-06-17
Hermes WebUI < 0.51.358 Unauthenticated Password Takeover via /api/settings
CVE-2026-49973_sync_session_title_to_insights _onboarding_gate_allows
Critical · CVSS 9.2
EPSS 0.7%2026-06-11
Hermes WebUI < 0.51.311 RCE via Git Configuration Injection
CVE-2026-49959_row_may_need_sidecar_metadata_refresh _webui_sidecar_lineage_messages_for_display _prefer_fuller_snapshots_for_sidebar
High · CVSS 8.7
EPSS 1.3%2026-06-09
Hermes WebUI < 0.51.303 TOCTOU Race Condition via git_discard
CVE-2026-49958_loadRunContent git_discard _expand_env_vars
Medium · CVSS 4.3
EPSS 0.1%2026-06-09
Hermes WebUI < 0.51.296 Workspace Boundary Bypass via api/workspace.py
CVE-2026-49957_remote_terminal_workspace_candidate
Medium · CVSS 6.3
EPSS 0.5%2026-06-09

Get an alert for each new nesquena/hermes-webui CVE, with the patched functions and AI-written analysis.

Monitor hermes-webui CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

1Panel-dev/MaxKB19 CVEs alextselegidis/easyappointments19 CVEs baserproject/basercms19 CVEs bookstackapp/bookstack19 CVEs cloudfoundry/uaa19 CVEs debian/dovecot19 CVEs debian/nginx19 CVEs debian/openimageio19 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in nesquena/hermes-webui.

How many CVEs have a located fix in nesquena/hermes-webui?: 19 published CVEs have a fix traced to functions in nesquena/hermes-webui, touching 95 functions across 28 files.
Which function in nesquena/hermes-webui has been patched by the most CVEs?: handle_post in api/routes.py has been changed by 4 CVE fixes, from 2026 to 2026.
How large is a typical CVE fix in nesquena/hermes-webui?: The median fix changes 92 lines. 16% of fixes change 20 lines or fewer, and 11% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

nesquena/hermes-webui on GitHub (opens in a new tab)
Patched functions directory
CWE directory: the weakness types behind these fixes

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track nesquena/hermes-webui CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing

On this page

Overview
Most patched functions
Most patched files
Fix size
Latest CVEs
Other repositories
FAQ
References