4 vulnerabilities across 4 products scored HIGH or above on October 20, 2026.

  • 🟠 HIGH: 4

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-103849 (adobe/adobe_commerce) — F1: theoretical → functional, AAS: 13.1 → 16.1 (CRITICAL → EMERGENCY). Originally in 2026-10-13 bulletin.
  • [UPGRADED] CVE-2026-105899 (adobe/coldfusion) — F1: exploitable → functional, AAS: 12.3 → 16.3 (CRITICAL → EMERGENCY). Originally in 2026-10-13 bulletin.
  • [UPGRADED] CVE-2026-70242 (microsoft/microsoft_365_apps_for_enterprise) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-10-13 bulletin.

🟠 [HIGH] chatchat-space/langchain-chatchat

1 CVE | CVSS 4.0: 9.3 | AAS 10.7

  • cpe:2.3:a:chatchat-space:langchain-chatchat:*:*:*:*:*:*:*:*

Langchain-Chatchat by chatchat-space through version 0.3.1.3 is affected by one HIGH-severity vulnerability (CVE-2026-75128, CVSS 9.3). The flaw exists in the POST /tools/call API endpoint, which allows any remote unauthenticated attacker to invoke registered tools by name, including a built-in shell tool that executes arbitrary operating system commands as the server process user. Because the shipped Docker image runs as root, successful exploitation grants full system-level command execution with a single HTTP request and no credentials.

Organizations running Langchain-Chatchat in any environment, particularly internet-facing or multi-tenant deployments, should treat this as an urgent priority. There is no authentication barrier to exploitation and the attack surface is trivial. Teams should immediately restrict network access to the affected endpoint, disable or remove the shell tool registration if not required, and monitor for any signs of compromise. Check the vendor advisory on GitHub for remediation guidance and apply patches or mitigations as soon as they become available.

Vendor Advisory

🟠 [HIGH] letta-ai/letta

1 CVE | CVSS 4.0: 9.3 | AAS 9.7

  • cpe:2.3:a:letta-ai:letta:*:*:*:*:*:*:*:*

Letta by letta-ai through version 0.16.8 is affected by one HIGH-severity vulnerability (CVE-2026-77936, CVSS 9.3). The default Docker Compose configuration ships without enabling LETTA_SERVER_SECURE, meaning no authentication middleware is applied to any API route, while simultaneously exposing a PostgreSQL superuser port with default credentials. Remote attackers can exploit this to execute arbitrary Python code via the tools endpoint, manipulate admin user accounts, or run operating system commands through PostgreSQL’s COPY PROGRAM functionality.

Any organization running Letta using the shipped compose.yaml, especially in network-accessible environments, should consider this an immediate priority. Teams should enable LETTA_SERVER_SECURE in their deployment configuration, change all default PostgreSQL credentials, and restrict network access to both the API and database ports. Review server logs for unauthorized access to /v1/tools/run and /v1/admin endpoints, and consult the vendor advisory on GitHub for updated deployment guidance.

Vendor Advisory

🟠 [HIGH] eosphoros-ai/db-gpt

1 CVE | CVSS 4.0: 9.3 | AAS 9.7

  • cpe:2.3:a:eosphoros-ai:db-gpt:*:*:*:*:*:*:*:*

DB-GPT by eosphoros-ai through version 0.8.2 is affected by one HIGH-severity vulnerability (CVE-2026-77932, CVSS 9.3). The /api/v1/chat/react-agent endpoint uses a mock authentication function that grants every caller the admin role regardless of credentials, allowing any unauthenticated remote attacker to submit prompts that trigger the ReAct agent’s unsandboxed code interpreter and shell interpreter tools. This results in arbitrary Python or bash execution as root within the webserver container, with direct access to the bundled database using default credentials.

Organizations deploying DB-GPT in any network-accessible configuration should treat this as critical. The combination of no authentication, unsandboxed code execution as root, and default database credentials makes exploitation trivial and high-impact. Teams should immediately restrict network access to the affected endpoint, implement proper authentication in place of the mock function, and audit containers for signs of unauthorized command execution. Monitor the vendor advisory on GitHub for patches and apply them as soon as available.

Vendor Advisory

🟠 [HIGH] tracer-cloud/opensre

1 CVE | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:tracer-cloud:opensre:*:*:*:*:*:*:*:*

OpenSRE by tracer-cloud through version 0.1.2026.10.19 is affected by one HIGH-severity vulnerability (CVE-2026-109444, CVSS 8.7). The headless presenter’s execution_allowed() function unconditionally returns True, completely bypassing the approval gate meant to require confirmation before shell command execution. Attackers can inject malicious instructions into alerts or Slack messages that the agent triages, causing arbitrary shell commands to run on the host and enabling exfiltration of LLM, Slack, and cloud credentials.

Organizations using OpenSRE in automated incident response or alert triage workflows should act immediately, particularly those with Slack-integrated deployments. The attack vector leverages poisoned alert content rather than direct access, making it exploitable by anyone who can influence upstream alert data. Teams should disable headless mode or patch the approval gate to require explicit human confirmation, rotate any credentials accessible to the agent, and audit logs for unexpected shell_run activity. Consult the vendor advisory on GitHub for remediation updates.

Vendor Advisory