Modeltc Lightllm vulnerabilities

• modeltc lightllm LightLLM through 1.2.0 Unauthenticated DoS via pd_kv_trans_params Deserialization CVE-2026-111160 8.7 HighOctober 15, 2026
• modeltc lightllm LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service CVE-2026-103395 9.3 CriticalSeptember 30, 2026
• modeltc lightllm LightLLM through 1.2.0 Missing Authentication on RL Control Routes CVE-2026-103270 8.7 HighSeptember 30, 2026
• modeltc lightllm LightLLM through 1.2.0 Server-Side Request Forgery via multimodal endpoints CVE-2026-103243 6.9 MediumSeptember 30, 2026
• modeltc lightllm LightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_value CVE-2026-103042 8.7 HighSeptember 29, 2026
• modeltc lightllm LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC Service CVE-2026-103041 9.3 CriticalSeptember 29, 2026
• modeltc lightllm LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Service CVE-2026-103040 9.3 CriticalSeptember 29, 2026
• modeltc lightllm LightLLM through 1.2.0 Unauthenticated Remote Code Execution via NCCL PD RPyC Control Channel CVE-2026-96560 9.3 CriticalSeptember 23, 2026
• modeltc lightllm LightLLM through 1.2.0 Missing Authentication in PD Master /pd_register WebSocket Endpoint CVE-2026-93839 9.3 CriticalSeptember 18, 2026
• modeltc lightllm LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle Deserialization CVE-2026-90919 9.3 CriticalSeptember 14, 2026
• modeltc lightllm LightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCE CVE-2026-26220 9.3 CriticalFebruary 17, 2026