Login Request a demo
LI
Product
LightLLM
by ModelTC · last CVE Oct 15, 2026
11
CVEs
0
On KEV
9.8
Max CVSS
7
New 30D
Vulnerabilities11In the news0Timeline
Severity mix
Critical 7High 3Medium 1Low 0
Severity
All severities11Critical7High3Medium1Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add LightLLM to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-103395
9.8
1%
Sep 30
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service
Affected: through 1.2.0
CVE-2026-103041
9.8
1%
Sep 29
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC Service
Affected: through 1.2.0
CVE-2026-103040
9.8
1%
Sep 29
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Service
Affected: through 1.2.0
CVE-2026-96560
9.8
1%
Sep 23
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via NCCL PD RPyC Control Channel
Affected: through 1.2.0
CVE-2026-93839
9.8
1%
Sep 18
LightLLM through 1.2.0 Missing Authentication in PD Master /pd_register WebSocket Endpoint
Affected: through 1.2.0
CVE-2026-90919
9.8
1%
Sep 14
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle Deserialization
Affected: through 1.2.0
CVE-2026-26220
9.3
1%
Feb 17
LightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCE
Affected: through 1.1.0
CVE-2026-111160
7.5
0%
Oct 15
LightLLM through 1.2.0 Unauthenticated DoS via pd_kv_trans_params Deserialization
Affected: through 1.2.0
CVE-2026-103270
7.5
1%
Sep 30
LightLLM through 1.2.0 Missing Authentication on RL Control Routes
Affected: through 1.2.0
CVE-2026-103042
7.5
1%
Sep 29
LightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_value
Affected: through 1.2.0
CVE-2026-103243
5.8
0%
Sep 30
LightLLM through 1.2.0 Server-Side Request Forgery via multimodal endpoints
Affected: through 1.2.0
Showing 11