CVE ID :CVE-2026-119706 Published : Oct. 30, 2026, 3:16 p.m. | 44 minutes ago Description :InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights...

#Sicherheitslücke #Update

Original-Artikel öffnen Zurück zur Übersicht

ARTICLEVIEW

CVE-2026-119706 - LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization

VERWANDTEARTIKEL

CVE-2026-93327 - Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Execution

CVE-2026-61729 - SOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Invocation and Alert Injection

CVE-2026-61730 - SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount

CVE-2026-61737 - ng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in ng-antd-admin

CVE-2026-61738 - SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE)

CVE-2026-61708 - SOCFortress CoPilot: Cross-Tenant Arbitrary Object-Store Write via the Data-Store Upload Endpoint (customer_user)