Login Request a demo
LM
Product
lmdeploy
by InternLM · last CVE Sep 18, 2026
13
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities13In the news1Timeline
Severity mix
Critical 3High 10Medium 0Low 0
Severity
All severities13Critical3High10Medium0Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add lmdeploy to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-66455
9.8
1%
Sep 18
LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py
Affected: >= 0.9.2, < 0.16.0
CVE-2025-59953
9.8
1%
Sep 16
LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy
Affected: >= 0.9.1, < 0.10.2
CVE-2026-76850
9.8
1%
Aug 19
LMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer Connector
Affected: 0.9.2 before 0.16.0
CVE-2026-33625
8.8
0%
Sep 18
LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading
Affected: >= 0.12.1, < 0.12.3
CVE-2025-67729
8.8
1%
Dec 26
lmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load()
Affected: < 0.11.1
CVE-2026-63764
8.6
1%
Jul 21
LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass
Affected: through 0.14.0
CVE-2026-46517
7.8
0%
Jun 9
LMDeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out
Affected: <= 0.12.3
CVE-2026-46432
7.8
0%
Jun 9
LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initialization
Affected: <= 0.12.3
CVE-2025-3163
7.8
0%
Apr 3
InternLM LMDeploy conf.py open code injection
Affected: 0.7.0; 0.7.1
CVE-2025-3162
7.8
0%
Apr 3
InternLM LMDeploy PT File utils.py load_weight_ckpt deserialization
Affected: 0.7.0; 0.7.1
CVE-2026-92983
7.5
1%
Sep 17
InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID Mismatch
Affected: through 0.17.0
CVE-2026-92971
7.5
1%
Sep 17
InternLM LMDeploy through 0.17.0 Assertion Denial of Service
Affected: through 0.17.0
CVE-2026-33626
7.5
45%
Apr 20
LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image Loading
Affected: < 0.12.3
Showing 13