Six critical CVEs disclosed in self-hosted AI agents Letta, DB-GPT and piflow

Six critical CVEs (CVSS 9.8) have been disclosed affecting self-hosted AI agents including Letta, DB-GPT and piflow, with default local environments lacking authentication, exposing unauthenticated HTTP/SSE endpoints that could leave backdoors for hackers.

Detected & updated continuously · Source: Nebula