high · CVSS v3 8.1 · CVSS v4 8.6 · EPSS 0.00401

CVE-2026-77937

Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users …

Description

Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id to another tenant's ID, even with LETTA_SERVER_SECURE enabled, to read and modify that user's agents, memory and configuration.

Scores

Severity
high
CVSS v2
8.5
CVSS v3
8.1
CVSS v4
8.6
EPSS
0.00401

← All CVEs

Related CVEs

high

CVE-2026-105453

IBM Sterling Connect Direct for Unix contains a vulnerability in privilege management that allows local attackers to escalate their access. This flaw affects versions 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6. It is critical for environments where this file transfer solution is deployed with local user access.

View analysis

high

CVE-2026-107366

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain an authorization flaw in message endpoints that allows any authenticated user to manipulate other users' data. This vulnerability enables bulk deletion, content overwriting, and session hijacking without proper ownership verification.

View analysis

high

CVE-2026-109126

IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 appliances contain hard‑coded credentials that can be used by a physically proximate attacker to gain elevated privileges. This flaw allows local attackers to bypass authentication and potentially take full control of the appliance. The vulnerability is rated high severity with a CVSS v3 score of 8.8.

View analysis

high

CVE-2026-112373

H3C Magic NX15 devices running version NX15V100R017 contain a stack-based buffer overflow vulnerability in the /usr/bin/usrlist binary. This flaw allows for remote exploitation, posing a significant risk to network infrastructure integrity. The vulnerability has been publicly disclosed, increasing the likelihood of active scanning and exploitation attempts.

View analysis