The nesquena hermes-webui product has a vulnerability that allows authenticated attackers to delete files outside the session directory.

🚨 EUVD-2026-24515 📊 Score: 4.8/10 (CVSS v3.1) 📦 Product: hermes-webui 🏢 Vendor: nesquena 📅 Updated: 2026-04-21 📝 nesquena hermes-webui contains an environment variable leakage vulnerability where profile switching does not clear environment variables from the previously active profile before loading the next profile. Attackers or users can exploit additive dotenv... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24515 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24517 📊 Score: 7.2/10 (CVSS v3.1) 📦 Product: hermes-webui 🏢 Vendor: nesquena 📅 Updated: 2026-04-21 📝 Hermes WebUI contains an arbitrary file deletion vulnerability in the /api/session/delete endpoint that allows authenticated attackers to delete files outside the session directory by supplying an absolute path or path traversal payload in the session_... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24517 #cybersecurity #infosec #euvd #cve #vulnerability