CVE-2026-101918 vulnerabilities

Vulnerabilities for packages: airflow-core, azureml-inference-server-http, openstack-glance-2026.1-fips, nemo-rl-cuda-13.0, datahub-ingestion-fips, openstack-octavia-2025.2, openstack-placement-2026.1-fips, superset, tritonserver-backend-vllm-cuda-13.0, semgrep, airflow, awx, request-1276,...

gllm-core-binary (>=0.0.0.dev0, <=0.4.4b3), gllm-inference-binary (0.5.51b3) +5 more potentially affected by CVE-2026-102937 via virtualenv (20.30.0)

virtualenv PYPI version 20.30.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - gllm-core-binary =0.0.0.dev0, =0.3.149, =0.1.0, =1.0.51, =0.4.4, =0.4.8 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3...

gllm-core-binary (>=0.0.0.dev0, <=0.4.4b3), gllm-inference-binary (0.5.51b3) +5 more potentially affected by CVE-2026-102938 via virtualenv (20.30.0)

virtualenv PYPI version 20.30.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - gllm-core-binary =0.0.0.dev0, =0.3.149, =0.1.0, =1.0.51, =0.4.4, =0.4.8 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-G...

GHSA-R6X4-923Q-G947 vulnerabilities

Vulnerabilities for packages: airflow-core, azureml-inference-server-http, openstack-glance-2026.1-fips, nemo-rl-cuda-13.0, datahub-ingestion-fips, openstack-octavia-2025.2, openstack-placement-2026.1-fips, superset, semgrep, openstack-horizon-2025.1, openstack-nova-2025.2,...

GHSA-HJ66-6F7G-4R5V vulnerabilities

Vulnerabilities for packages: kserve-lgbserver-fips, azureml-inference-server-http, chroma, kubeflow-pipelines-visualization-server, kubeflow-volumes-web-app, prefect, pgadmin4-fips, ansible-operator-fips, jupyter-base-notebook, kubeflow-katib, dagster-fips, airflow, awx,...

GHSA-W2CX-738M-MC7W vulnerabilities

Vulnerabilities for packages: airflow-core, azureml-inference-server-http, openstack-glance-2026.1-fips, nemo-rl-cuda-13.0, datahub-ingestion-fips, openstack-octavia-2025.2, openstack-placement-2026.1-fips, superset, semgrep, openstack-horizon-2025.1, openstack-nova-2025.2,...

GHSA-HXM8-2XGR-2P9M vulnerabilities

Vulnerabilities for packages: airflow-core, azureml-inference-server-http, openstack-glance-2026.1-fips, nemo-rl-cuda-13.0, datahub-ingestion-fips, openstack-octavia-2025.2, openstack-placement-2026.1-fips, superset, semgrep, airflow, openstack-horizon-2025.1, openstack-nova-2025.2,...

GHSA-XPV3-W29H-X7CV vulnerabilities

Vulnerabilities for packages: kserve-lgbserver-fips, azureml-inference-server-http, chroma, kubeflow-pipelines-visualization-server, kubeflow-volumes-web-app, prefect, pgadmin4-fips, ansible-operator-fips, jupyter-base-notebook, kubeflow-katib, dagster-fips, airflow, awx,...

CVE-2026-49264 vulnerabilities

Vulnerabilities for packages: kserve-lgbserver-fips, azureml-inference-server-http, chroma, kubeflow-pipelines-visualization-server, kubeflow-volumes-web-app, prefect, pgadmin4-fips, ansible-operator-fips, jupyter-base-notebook, kubeflow-katib, dagster-fips, airflow, awx,...

CVE-2026-49265 vulnerabilities

Vulnerabilities for packages: kserve-lgbserver-fips, azureml-inference-server-http, chroma, kubeflow-pipelines-visualization-server, kubeflow-volumes-web-app, prefect, pgadmin4-fips, ansible-operator-fips, jupyter-base-notebook, kubeflow-katib, dagster-fips, airflow, awx,...

GHSA-W6J9-CWV2-H6WQ vulnerabilities

Vulnerabilities for packages: airflow-core, azureml-inference-server-http, openstack-glance-2026.1-fips, nemo-rl-cuda-13.0, datahub-ingestion-fips, openstack-octavia-2025.2, openstack-placement-2026.1-fips, superset, semgrep, airflow, openstack-horizon-2025.1, openstack-nova-2025.2,...

GHSA-2GX3-RCP4-G85Q vulnerabilities

Vulnerabilities for packages: airflow-core, azureml-inference-server-http, openstack-glance-2026.1-fips, nemo-rl-cuda-13.0, datahub-ingestion-fips, openstack-octavia-2025.2, openstack-placement-2026.1-fips, superset, semgrep, airflow, openstack-horizon-2025.1, openstack-nova-2025.2,...

GHSA-P4G4-X82P-Q773 vulnerabilities

Vulnerabilities for packages: airflow-core, azureml-inference-server-http, openstack-glance-2026.1-fips, nemo-rl-cuda-13.0, datahub-ingestion-fips, openstack-octavia-2025.2, openstack-placement-2026.1-fips, superset, semgrep, airflow, openstack-horizon-2025.1, openstack-nova-2025.2,...

CVE-2026-102274 vulnerabilities

Vulnerabilities for packages: airflow-core, azureml-inference-server-http, openstack-glance-2026.1-fips, nemo-rl-cuda-13.0, datahub-ingestion-fips, openstack-octavia-2025.2, openstack-placement-2026.1-fips, superset, semgrep, airflow, openstack-horizon-2025.1, openstack-nova-2025.2,...

CVE-2026-102271 vulnerabilities

Vulnerabilities for packages: airflow-core, azureml-inference-server-http, openstack-glance-2026.1-fips, nemo-rl-cuda-13.0, datahub-ingestion-fips, openstack-octavia-2025.2, openstack-placement-2026.1-fips, superset, semgrep, airflow, openstack-horizon-2025.1, openstack-nova-2025.2,...

CVE-2026-103270

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pausegeneration, /abortrequest, /flushcache, and /initweightsupdategroup to disrupt inference operations and wedge workers o...

CVE-2026-103270 LightLLM through 1.2.0 Missing Authentication on RL Control Routes

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pausegeneration, /abortrequest, /flushcache, and /initweightsupdategroup to disrupt inference operations and wedge workers o...

EUVD-2026-89989

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pausegeneration, /abortrequest, /flushcache, and /initweightsupdategroup to disrupt inference operations and wedge workers o...

CVE-2026-103270

LightLLM versions up to and including 1.2.0 are vulnerable to a missing authentication flaw on reinforcement learning (RL) control routes. When deployments are started with the --enable_rl flag, the software mounts specific control routes on the public HTTP API without requiring authentication ch...

CVE-2026-103270 LightLLM through 1.2.0 Missing Authentication on RL Control Routes

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pausegeneration, /abortrequest, /flushcache, and /initweightsupdategroup to disrupt inference operations and wedge workers o...