Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-39wr-7q6h-cf68
  • PyPI/lmdeploy
 LMDeploy has an SSRF bypass 18 Sep
  • Fix available
  • Severity - 7.5 (High)
CVE-2026-33625
  • github.com/internlm/lmdeploy
 LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading 18 Sep
  • Fix available
  • Severity - 8.8 (High)
GHSA-3hmm-rh5q-gwwr
  • PyPI/lmdeploy
 LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading 18 Sep
  • Fix available
  • Severity - 8.8 (High)
GHSA-2vh9-42vm-xmv2
  • PyPI/lmdeploy
 LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py 18 Sep
  • Fix available
  • Severity - 9.8 (Critical)
CVE-2025-66455
  • github.com/internlm/lmdeploy
 LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py 18 Sep
  • Fix available
  • Severity - 9.8 (Critical)
CVE-2026-92983
  • github.com/internlm/lmdeploy
 InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID Mismatch 17 Sep
  • Fix available
  • Severity - 8.7 (High)
CVE-2026-92971
  • github.com/internlm/lmdeploy
 InternLM LMDeploy through 0.17.0 Assertion Denial of Service 17 Sep
  • Fix available
  • Severity - 8.7 (High)
CVE-2025-59953
  • github.com/internlm/lmdeploy
 LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy 16 Sep
  • Fix available
  • Severity - 9.8 (Critical)
GHSA-5h8j-6crg-7rmw
  • PyPI/lmdeploy
 LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy 16 Sep
  • Fix available
  • Severity - 9.8 (Critical)
CVE-2026-76850
  • github.com/internlm/lmdeploy
 LMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer Connector 19 Aug
  • Fix available
  • Severity - 9.3 (Critical)
CVE-2026-63764
  • github.com/internlm/lmdeploy
 LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass 21 Jul
  • Fix available
  • Severity - 7.7 (High)
PYSEC-2026-2608
  • PyPI/lmdeploy
 lmdeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out 13 Jul
  • No fix available
  • Severity - 7.8 (High)
PYSEC-2026-2609
  • PyPI/lmdeploy
 LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initialization 13 Jul
  • Fix available
  • Severity - 7.8 (High)
PYSEC-2026-2607
  • PyPI/lmdeploy
 LMDeploy has Server-Side Request Forgery (SSRF) via Vision-Language Image Loading 13 Jul
  • No fix available
  • Severity - 7.5 (High)
PYSEC-2026-1578
  • PyPI/lmdeploy
 lmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load() 07 Jul
  • Fix available
  • Severity - 8.8 (High)
PYSEC-2026-1579
  • PyPI/lmdeploy
 InternLM LMDeploy code injection vulnerability 07 Jul
  • No fix available
  • Severity - 4.8 (Medium)
Load more...