CVE-2026-9350

HighCVSS 7.3/10Last modified Jul 23, 2026

Description

A vulnerability was identified in NousResearch hermes-agent up to 2026.4.16. This affects the function check_all_command_guards of the file tools/approval.py of the component Batch Runner. Such manipulation leads to missing authorization. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-862 CWE-863

Affected software

No affected versions have been published.

Timeline

Published: May 24, 2026
Last modified: Jul 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-935046.3A vulnerability has been found in SveltyCMS 0.0.6. This affects an unknown part of the file src/routes/api/[...path]/+server.ts of the compo CVE-2026-935053.5A vulnerability was found in SveltyCMS 0.0.6. This vulnerability affects unknown code of the file src/utils/media/media-service.server.ts of CVE-2026-935066.3A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the CVE-2026-935073.3The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, all CVE-2026-935088.1The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authent CVE-2026-935096.5The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes th CVE-2026-93516.5A security flaw has been discovered in NousResearch hermes-agent up to 2026.4.16. This vulnerability affects the function _is_blocked_device CVE-2026-935104.3The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call i CVE-2026-935115.3The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription no CVE-2026-935127.1Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.CVE-2026-935134.3Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions.CVE-2026-935147.1Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions.