Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 25

CVE-2026-7302

CVE-2026-7302

SGLangs multimodal generation runtime is vulnerable to an unauthenticated path traversal vulnerability, allowing an attacker to write arbitrary files anywhere the server process has write access, by including ../ sequences in the upload filename when sent to specific endpoints.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Lmsys Sglang
Products
Sglang Sglang
CVE-2026-7304

CVE-2026-7304

SGLangs multimodal generation runtime is vulnerable to unauthenticated remote code execution when the --enable-custom-logit-processor option is enabled, as Python objects loaded via dill.loads() will be deserialized without validation.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Lmsys Sglang
Products
Sglang Sglang
CVE-2026-3989

CVE-2026-3989

SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization. An attacker can take advantage of this by providing a malicious .pkl file, which will execute the attackers code on the device running the script.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Lmsys Sglang
Products
Sglang Sglang
CVE-2026-3060

CVE-2026-3060

SGLang' encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes untrusted data using pickle.loads() without authentication.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed
Vendors
Lmsys Sglang
Products
Sglang Sglang
CVE-2026-3059

CVE-2026-3059

SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using pickle.loads() without authentication.

CVSS 3.1 · 9.8 Critical EPSS 1.8% KEV · Not listed
Vendors
Lmsys Sglang
Products
Sglang Sglang