https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-30T17:04:34.018593+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-90919 fkie_cve-2026-90919 2026-09-30T17:04:34.037229+00:00

LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visual_register WebSocket endpoint that passes the first client frame directly to pickle.loads(). Attackers can reach the Config Server port and send a malicious serialized payload with a __reduce__ method to execute arbitrary code with Config Server process privileges.

 https://db.gcve.eu/vuln/ghsa-6qph-w2vp-jm84 GHSA-6qph-w2vp-jm84 2026-09-30T17:04:34.037326+00:00

LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visual_register WebSocket endpoint that passes the first client frame directly to pickle.loads(). Attackers can reach the Config Server port and send a malicious serialized payload with a __reduce__ method to execute arbitrary code with Config Server process privileges.