Published threat advisories for October 20, 2026

The Letta application, up to version 0.16.8, has a critical vulnerability due to an insecure default configuration. This allows unauthenticated access to all API routes and exposes a superuser PostgreSQL port with default credentials. Attackers can exploit this to execute arbitrary code, manage users, or run OS command

NVD modified: NVD date unavailable

A vulnerability in DB-GPT allows attackers to gain full database access due to hardcoded credentials in its default configuration. If reachable, unauthorized users could authenticate as root, potentially leading to data compromise or modification. This is significant as it exposes sensitive information and grants broad

NVD modified: NVD date unavailable

An unauthenticated remote code execution vulnerability exists in DB-GPT due to a flawed authentication mechanism in the `/api/v1/chat/react-agent` endpoint, allowing attackers to run arbitrary code as root. This could lead to unauthorized access to the bundled database and other system resources within the web server c

NVD modified: NVD date unavailable

The piflow DeepAgents chat agent has a critical remote code execution vulnerability. Unauthenticated attackers can exploit this by instructing the agent to run arbitrary commands, potentially exposing sensitive secrets like API keys and database credentials. This issue is reachable via network and requires no authentic

NVD modified: NVD date unavailable