MO
Vendor
ModelTC
12
CVEs
0
On KEV
8
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-111160 | LI LightLLM ModelTC | 7.5 | Oct 15 | LightLLM through 1.2.0 Unauthenticated DoS via pd_kv_trans_params Deserialization |
| CVE-2026-108943 | LI LightX2V ModelTC | 5.3 | Oct 13 | ModelTC LightX2V Tokenizer cosmos3_runner.py AutoTokenizer.from_pretrained code injection |
| CVE-2026-103395 | LI LightLLM ModelTC | 9.8 | Sep 30 | LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service |
| CVE-2026-103270 | LI LightLLM ModelTC | 7.5 | Sep 30 | LightLLM through 1.2.0 Missing Authentication on RL Control Routes |
| CVE-2026-103243 | LI LightLLM ModelTC | 5.8 | Sep 30 | LightLLM through 1.2.0 Server-Side Request Forgery via multimodal endpoints |
| CVE-2026-103042 | LI LightLLM ModelTC | 7.5 | Sep 29 | LightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_value |
| CVE-2026-103041 | LI LightLLM ModelTC | 9.8 | Sep 29 | LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC Service |
| CVE-2026-103040 | LI LightLLM ModelTC | 9.8 | Sep 29 | LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Service |
| CVE-2026-96560 | LI LightLLM ModelTC | 9.8 | Sep 23 | LightLLM through 1.2.0 Unauthenticated Remote Code Execution via NCCL PD RPyC Control Channel |
| CVE-2026-93839 | LI LightLLM ModelTC | 9.8 | Sep 18 | LightLLM through 1.2.0 Missing Authentication in PD Master /pd_register WebSocket Endpoint |
| CVE-2026-90919 | LI LightLLM ModelTC | 9.8 | Sep 14 | LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle Deserialization |
| CVE-2026-26220 | LI LightLLM ModelTC | 9.3 | Feb 17 | LightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCE |