LM
Product
lmdeploy
13
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 10Medium 0Low 0
Watch
Add lmdeploy to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-33625 | 8.8 | Sep 18 | LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading Affected: >= 0.12.1, < 0.12.3 |
| CVE-2025-67729 | 8.8 | Dec 26 | lmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load() Affected: < 0.11.1 |
| CVE-2026-63764 | 8.6 | Jul 21 | LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass Affected: through 0.14.0 |
| CVE-2026-46517 | 7.8 | Jun 9 | LMDeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out Affected: <= 0.12.3 |
| CVE-2026-46432 | 7.8 | Jun 9 | LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initialization Affected: <= 0.12.3 |
| CVE-2025-3163 | 7.8 | Apr 3 | InternLM LMDeploy conf.py open code injection Affected: 0.7.0; 0.7.1 |
| CVE-2025-3162 | 7.8 | Apr 3 | InternLM LMDeploy PT File utils.py load_weight_ckpt deserialization Affected: 0.7.0; 0.7.1 |
| CVE-2026-92983 | 7.5 | Sep 17 | InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID Mismatch Affected: through 0.17.0 |
| CVE-2026-92971 | 7.5 | Sep 17 | InternLM LMDeploy through 0.17.0 Assertion Denial of Service Affected: through 0.17.0 |
| CVE-2026-33626 | 7.5 | Apr 20 | LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image Loading Affected: < 0.12.3 |
Showing 10