CVE-2026-31239: Deserialization of Untrusted Data

The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization CWE-502 when loading pre-trained models from HuggingFace Hub. The MambaLMHeadModel.frompretrained method uses torch.load to load the pytorchmodel.bin weight file without enabling the security-restrictive...

The vulnerability of the ImportedPlugin.importCommunityItemFromUrl() function in the LLM system’s runtime and management framework allows a malicious actor to execute arbitrary code.

The vulnerability of the ImportedPlugin.importCommunityItemFromUrl function in the LLM system is related to an incorrect restriction on the path name of the catalog. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

vLLM 安全漏洞

vLLM is a high throughput and memory efficient inference and service engine for LLM from vLLM open source. A security vulnerability exists in vLLM version 0.5.5 through versions prior to 0.11.1, which stems from insufficient validation of the chattemplatekwargs parameter, and may result in API...