pupy

Pupy Simple Installation pip3 install pipx pipx ensurepath pipx install git+https://github.com/n1nj4sec/pupy@nextgen pupysh If you want more detailed informationRefer to the wiki Development Install git clone https://github.com/n1nj4sec/pupy cd pupy git checkout nextgen git submodule init git...

PT-2026-105749

These are all security issues fixed in the python313-rpyc-6.0.2-1.5 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:12040-1 python313-rpyc-6.0.2-1.5 on GA media

These are all security issues fixed in the python313-rpyc-6.0.2-1.5 package on the GA media of openSUSE Tumbleweed...

CVE-2026-103395

LightLLM through 1.2.0 visualonly deployments expose an unauthenticated RPyC service with allowpickle enabled that deserializes attacker-supplied arguments in the remoteinferimages method. Attackers can reach the visual RPyC port and pass objects with reduce methods to execute arbitrary code with...

EUVD-2026-89990

LightLLM through 1.2.0 visualonly deployments expose an unauthenticated RPyC service with allowpickle enabled that deserializes attacker-supplied arguments in the remoteinferimages method. Attackers can reach the visual RPyC port and pass objects with reduce methods to execute arbitrary code with...

CVE-2026-103395 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service

LightLLM through 1.2.0 visualonly deployments expose an unauthenticated RPyC service with allowpickle enabled that deserializes attacker-supplied arguments in the remoteinferimages method. Attackers can reach the visual RPyC port and pass objects with reduce methods to execute arbitrary code with...

CVE-2026-103395

Versions of LightLLM through 1.2.0 with visual_only deployments are vulnerable to Unauthenticated Remote Code Execution (RCE) . The issue stems from an exposed RPyC service where the allow_pickle option is enabled, allowing the remote_infer_images method to deserialize untrusted arguments. An att...

CVE-2026-103395 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service

LightLLM through 1.2.0 visualonly deployments expose an unauthenticated RPyC service with allowpickle enabled that deserializes attacker-supplied arguments in the remoteinferimages method. Attackers can reach the visual RPyC port and pass objects with reduce methods to execute arbitrary code with...

CVE-2026-103395 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service

LightLLM through 1.2.0 visualonly deployments expose an unauthenticated RPyC service with allowpickle enabled that deserializes attacker-supplied arguments in the remoteinferimages method. Attackers can reach the visual RPyC port and pass objects with reduce methods to execute arbitrary code with...

EUVD-2026-89482

LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to execute arbitrary code with service privileges...

EUVD-2026-89481

LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enableprofiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execute arbitrary code by sending crafted...

CVE-2026-103395: Deserialization of Untrusted Data

LightLLM through 1.2.0 visualonly deployments expose an unauthenticated RPyC service with allowpickle enabled that deserializes attacker-supplied arguments in the remoteinferimages method. Attackers can reach the visual RPyC port and pass objects with reduce methods to execute arbitrary code with...

PT-2026-103289

Name of the Vulnerable Software and Affected Versions LightLLM versions prior to 1.2.1 Description In visual only deployments, an unauthenticated RPyC service is exposed with allow pickle enabled. This configuration allows the remote infer images function to deserialize attacker-supplied argument...

CVE-2026-103041

LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to execute arbitrary code with service privileges...

CVE-2026-103040

LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enableprofiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execute arbitrary code by sending crafted...

CVE-2026-103040 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Service

LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enableprofiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execute arbitrary code by sending crafted...

CVE-2026-103041 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC Service

LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to execute arbitrary code with service privileges...

CVE-2026-103040 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Service

LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enableprofiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execute arbitrary code by sending crafted...

CVE-2026-103041

LightLLM versions through 1.2.0 in multimodal deployments are vulnerable to Remote Code Execution (RCE) . The flaw exists because an unauthenticated RPyC cache service is exposed on all interfaces with pickle deserialization enabled. An attacker can send crafted serialized objects to the exposed ...

CVE-2026-103040

LightLLM versions through 1.2.0 are vulnerable to remote code execution (RCE) within the router profiler service when the --enable_profiling flag is used. The root cause is the exposure of an unauthenticated RPyC server with pickle deserialization enabled. This allows an attacker to execute arbit...