https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T12:52:27.567852+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-336553 EUVD-2026-336553 2026-10-06T12:52:27.616353+00:00 EUVD-2026-336553 https://cve.radiocsirt.org/vuln/fkie_cve-2026-22677 fkie_cve-2026-22677 2026-10-06T12:52:27.616390+00:00

Hermes WebUI prior to 0.51.44 contains a path traversal vulnerability in the session import endpoint that allows authenticated attackers to read arbitrary files by importing a crafted session with an unrestricted workspace value. Attackers can supply a blocked filesystem root in the workspace field and subsequently use relative paths in the session file API to access any file readable by the WebUI process.

 https://cve.radiocsirt.org/vuln/ghsa-wvw9-5wfm-7729 GHSA-wvw9-5wfm-7729 2026-10-06T12:52:27.616423+00:00

Hermes WebUI prior to 0.51.44 - Release T contains a path traversal vulnerability in the session import endpoint that allows authenticated attackers to read arbitrary files by importing a crafted session with an unrestricted workspace value. Attackers can supply a blocked filesystem root in the workspace field and subsequently use relative paths in the session file API to access any file readable by the WebUI process.