[ Vendor · 9 CVEs ]
ModelTC
CVEs affecting ModelTC published in the last 30 days, plus any ModelTC CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-111160 | 15 Oct 2026 | CVSS 7.5 | ModelTC LightLLMLightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying… | |
| CVE-2026-108943 | 13 Oct 2026 | CVSS 5.3 | ModelTC LightX2VA weakness has been identified in ModelTC LightX2V up to 0.5.0. Affected is the function AutoTokenizer.from_pretrained of the file… | |
| CVE-2026-103395 | 30 Sep 2026 | CVSS 9.8 | ModelTC LightLLMLightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied… | |
| CVE-2026-103243 | 30 Sep 2026 | CVSS 5.8 | ModelTC LightLLMLightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenticated attackers to perform… | |
| CVE-2026-103270 | 30 Sep 2026 | CVSS 7.5 | ModelTC LightLLMLightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers… | |
| CVE-2026-103040 | 29 Sep 2026 | CVSS 9.8 | ModelTC LightLLMLightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enable_profiling flag. The… | |
| CVE-2026-103041 | 29 Sep 2026 | CVSS 9.8 | ModelTC LightLLMLightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces… | |
| CVE-2026-103042 | 29 Sep 2026 | CVSS 7.5 | ModelTC LightLLMLightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pd_trans_mode nccl, allowing… | |
| CVE-2026-96560 | 23 Sep 2026 | CVSS 9.8 | ModelTC LightLLMLightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when started with --pd_trans_mode nccl, which exposes… |