{"vulnerability": "CVE-2026-7777", "sightings": [{"uuid": "0c87dede-04e9-4c31-9a61-83e3a9a16ee9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7777", "type": "seen", "source": "Telegram/snqalfjRGyeCByylJf6ek_8lwbWnhtUi9PGLk9MnmWsBvV0", "content": "", "creation_timestamp": "2026-08-03T08:00:03.276136Z"}, {"uuid": "b0b1f2e8-1b1b-48c1-94c3-28b1f13476e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7777", "type": "published-proof-of-concept", "source": "Telegram/snqalfjRGyeCByylJf6ek_8lwbWnhtUi9PGLk9MnmWsBvV0", "content": "", "creation_timestamp": "2026-08-04T00:00:44.199355Z"}, {"uuid": "1413b4a3-cb03-4315-b506-afa9708904eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77776", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtmnpvkdmn2b", "content": "CVE-2026-77776 - headroom\nThe Headroom service that sits in front of AI models accepts a custom header called x-headroom-user-id and trusts it to decide whose data to access. Because the service does\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#headroom #headroomlabs #CVE #infosec", "creation_timestamp": "2026-08-21T21:00:05.936503Z"}, {"uuid": "7c1783a8-5f20-4b69-a7d9-6baeb6a6f8b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77776", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtno4xh7n42f", "content": "CVE-2026-77776\nHeadroom\u2019s language\u2011model gateway decides whose stored data to use based on a request header called x-headroom-user-id. Because the gateway does not verify that the caller actually owns that ID, anyone can send\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-22T06:40:06.382825Z"}, {"uuid": "62c3d447-9bb8-4742-b795-027221acf78a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-77776", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117133386151660614", "content": "CRITICAL: CVE-2026-77776 in Headroom Labs Headroom (<0.36.1) allows unauth'd attackers to spoof x-headroom-user-id and access/modify any user's LLM memory. Default configs expose this via 0.0.0.0 binding. Restrict access & use auth tokens. https://radar.offseq.com/threat/cve-2026-77776-authorization-bypass-through-user-controlled-key-in-headroom-labs-headroom-0c2eff15c1a3dc1f #OffSeq #CVE #infosec #LLM", "creation_timestamp": "2026-08-21T12:00:33.474614Z"}, {"uuid": "76c223bf-07f2-4f6b-9f33-c6a33b08a7bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-77776", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mtlpl4zilt2n", "content": "CVE-2026-77776: Headroom Labs Headroom (CRITICAL) lets remote attackers bypass auth using x-headroom-user-id, fully compromising user LLM memory. Deploy with strict access controls & enable authentication. https://radar.offseq.com/threat/cve-2026-77776-authorization-bypass-through-user-controlled...", "creation_timestamp": "2026-08-21T12:00:34.435943Z"}, {"uuid": "1229fa09-a40e-47a7-aff6-42314ad199c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77776", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/4scsaucho3ich", "content": "CVE-2026-77776 - Headroom Proxy Treats the Client-Supplied x-headroom-user-id Header as an Authenticated Identity\nCVE ID : CVE-2026-77776\n \n Published : Aug. 21, 2026, 11:22 a.m. | 33\u00a0minutes ago\n \n Description : Headroom's LLM proxy derives the memory owner from the x-headroo...", "creation_timestamp": "2026-08-21T12:13:30.073659Z"}, {"uuid": "9ce1f6df-2065-4d99-b2e7-66220e3f2614", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77775", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/6bhbuvl7wrj6c", "content": "CVE-2026-77775 - Headroom Proxy Sends Upstream Requests to a Client-Supplied Base URL Without Address Validation\nCVE ID : CVE-2026-77775\n \n Published : Aug. 21, 2026, 11:22 a.m. | 33\u00a0minutes ago\n \n Description : Headroom's LLM proxy lets a client choose the upstream destinatio...", "creation_timestamp": "2026-08-21T12:19:30.177848Z"}, {"uuid": "d9e725b5-f5a6-4b20-b2fa-de062735dafa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77775", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtlwc25wbi22", "content": "\ud83d\udfe0 CVE-2026-77775 - High (8.6)\n\nHeadroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url r...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-77775/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-21T14:00:47.373232Z"}, {"uuid": "40a8d901-23e5-44c6-a7bc-8add6b6b3fb7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77776", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtlwccp76p27", "content": "\ud83d\udd34 CVE-2026-77776 - Critical (9.1)\n\nHeadroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The hea...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-77776/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-21T14:00:54.644374Z"}, {"uuid": "26ba430b-0cbb-4246-ad3d-d859f81e2450", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77776", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtlwnnj7k224", "content": "\ud83d\udea8 CVE-2026-77776 \u2014 CVSS 9.3 CRITICAL\n\nHeadroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is rea...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-77776\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-21T14:07:14.177544Z"}, {"uuid": "615d61f8-89c0-42a4-84bc-07f4868e240b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77776", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mtlzqphljc2o", "content": "CVE-2026-77776 - Critical IDOR in Headroom LLM proxy. Spoof x-headroom-user-id to read/write other users' memory. CVSS 9.1. No patch yet - restrict access now. #CVE #Headroom #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-77776/", "creation_timestamp": "2026-08-21T15:02:38.049906Z"}, {"uuid": "c80f74ea-30bf-4dcd-a84a-f39fc1d42fef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77776", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117134102243290210", "content": "CVE-2026-77776 - Critical IDOR in Headroom LLM proxy. Spoof x-headroom-user-id to read/write other users' memory. CVSS 9.1. No patch yet - restrict access now. #CVE #Headroom #infosec\nhttps://www.valtersit.com/cve/CVE-2026-77776/", "creation_timestamp": "2026-08-21T15:02:47.962479Z"}, {"uuid": "cf952752-988f-4220-9f31-db2106f26ae0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77770", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mv65vpxz5s2r", "content": "CVE-2026-77770 - miniorange 2fa\nThe MiniOrange Two\u2011Factor Authentication plugin for WordPress (versions before 6.3.1 and before 19.3) can be tricked into removing important configuration entries\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#miniorange2fa #unknown #CVE #infosec", "creation_timestamp": "2026-09-10T13:30:09.020336Z"}, {"uuid": "6a58e83e-fec8-4fbe-949b-8efe811945cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77770", "type": "seen", "source": "https://bsky.app/profile/forsmile.jp/post/3mvarilwsfk2r", "content": "\u3010\u7dca\u6025\u3011miniOrange 2FA\uff08WordPress\uff09\u306b\u6df1\u523b\u306a\u8106\u5f31\u6027\uff08CVE-2026-77770 / CVSS v3.1 10.0 CRITICAL\uff09\n\n\u672a\u8a8d\u8a3c\u306e\u8a2a\u554f\u8005\u304c\u30b5\u30a4\u30c8\u306e\u8a2d\u5b9a\u5024\uff08option\uff09\u3092\u4efb\u610f\u306b\u524a\u9664\u3067\u304d\u3001\u5168\u7ba1\u7406\u8005\u306e\u7de0\u3081\u51fa\u3057\u3084\u5168\u30d7\u30e9\u30b0\u30a4\u30f3\u306e\u7121\u52b9\u5316\u306b\u3064\u306a\u304c\u308a\u307e\u3059\u3002\u5b9f\u8a3c\u30b3\u30fc\u30c9\u306f10\u67088\u65e5\u306b\u516c\u958b\u4e88\u5b9a\u3002\n\u5bfe\u51e6: \u7121\u6599\u7248\u306f6.3.1\u3001Pro\u7248\u306f19.3\u3078\u66f4\u65b0\u3057\u3066\u304f\u3060\u3055\u3044\u3002\n\nforsmile.jp/articles/min...\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #CVE", "creation_timestamp": "2026-09-11T14:26:04.250451Z"}, {"uuid": "64d6edb8-2fcb-42c5-9d8a-a0006fe6cccd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77774", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mve3pynjsv2p", "content": "\ud83d\udccc CVE-2026-77774 - Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this... https://www.cyberhub.blog/cves/CVE-2026-77774", "creation_timestamp": "2026-09-12T22:07:10.086243Z"}, {"uuid": "a084b3ca-b1a1-420a-956f-8d510a64ac39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77774", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mve5f66yge2a", "content": "\ud83d\udccc CVE-2026-77774 - Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this... https://www.potatohub.blog/cves/CVE-2026-77774", "creation_timestamp": "2026-09-12T22:36:55.563529Z"}, {"uuid": "144465de-297c-4a8d-bfb3-927e7b06911d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77770", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102168", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-77770\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a cflowsec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-13 03:51:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nminiOrange 2FA CVE POC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-13T07:00:05.326360Z"}, {"uuid": "3e77dc06-9cf6-49c2-aa56-5287adb48927", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77770", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102168", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-77770\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a cflowsec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-13 03:51:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nminiOrange 2FA CVE POC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-14T00:00:30.215823Z"}, {"uuid": "5dc4b443-1855-4e3c-a5c9-14f3955b4727", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77770", "type": "seen", "source": "Telegram/uk9yoRqcZiLOpAGjv24UEoeHuOZU_BlMWygh7B7a0pT6RpM", "content": "", "creation_timestamp": "2026-09-14T03:00:07.406014Z"}, {"uuid": "3045a488-50cb-4ff2-908a-76983d1d9d81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77771", "type": "seen", "source": "Telegram/_LVlgDwbFSGH2dS_S06nRHfzXTVGcYZJpOdIuQwz8F82lNw", "content": "", "creation_timestamp": "2026-09-14T03:00:12.178094Z"}, {"uuid": "7a5c3ded-907c-4044-b6fb-14120dff5658", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77771", "type": "published-proof-of-concept", "source": "Telegram/_LVlgDwbFSGH2dS_S06nRHfzXTVGcYZJpOdIuQwz8F82lNw", "content": "", "creation_timestamp": "2026-09-15T00:00:23.384693Z"}, {"uuid": "fe95f5b3-1562-4d0a-a111-ebdf25157905", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77770", "type": "published-proof-of-concept", "source": "Telegram/uk9yoRqcZiLOpAGjv24UEoeHuOZU_BlMWygh7B7a0pT6RpM", "content": "", "creation_timestamp": "2026-09-15T00:00:27.342902Z"}]}