Search
Search Results (6 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-15971 | 1 Sglang | 1 Sglang | 2026-07-31 | 9.8 Critical |
| SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPER_SERVER_PORT is set, enabling code execution on inference requests. | ||||
| CVE-2026-15976 | 1 Sglang | 1 Sglang | 2026-07-31 | 9.8 Critical |
| SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /update_weights_from_disk, where torch.load(..., weights_only=False) fallback enables pickle deserialization of .bin files. | ||||
| CVE-2026-15978 | 1 Sglang | 1 Sglang | 2026-07-31 | 7.5 High |
| SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights. | ||||
| CVE-2026-15974 | 1 Sglang | 1 Sglang | 2026-07-31 | 6.5 Medium |
| SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized image_url, allowing access to internal metadata, secrets, and services. | ||||
| CVE-2026-15977 | 1 Sglang | 1 Sglang | 2026-07-31 | 7.5 High |
| SGLang contains a credential leakage vulnerability in the /server_info endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured. | ||||
| CVE-2026-15969 | 1 Sglang | 1 Sglang | 2026-07-31 | 9.8 Critical |
| SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads. | ||||
Page 1 of 1.