ModelTC LightLLM

• CVE-2026-111160 High 7.5 LightLLM through 1.2.0 Unauthenticated DoS via pd_kv_trans_params Deserialization 0.4%
• CVE-2026-103395 Critical 9.8 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service 0.6%
• CVE-2026-103270 High 7.5 LightLLM through 1.2.0 Missing Authentication on RL Control Routes 0.5%
• CVE-2026-103243 Medium 5.8 LightLLM through 1.2.0 Server-Side Request Forgery via multimodal endpoints 0.3%
• CVE-2026-103042 High 7.5 LightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_value 0.6%
• CVE-2026-103041 Critical 9.8 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC Service 0.8%
• CVE-2026-103040 Critical 9.8 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Service 1.0%
• CVE-2026-96560 Critical 9.8 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via NCCL PD RPyC Control Channel 1.2%
• CVE-2026-93839 Critical 9.8 LightLLM through 1.2.0 Missing Authentication in PD Master /pd_register WebSocket Endpoint 0.8%
• CVE-2026-90919 Critical 9.8 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle Deserialization 1.1%
• CVE-2026-26220 Critical 9.3 LightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCE 1.0%