CVE-2026-119706

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /updateweights endpoint. Attackers can submit a base64-encoded crafted pickle in serializednamedtensors, which...

CVE-2026-119706: InternLM lmdeploy: InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows…

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /updateweights endpoint. Attackers can submit a base64-encoded crafted pickle in serializednamedtensors, which...

PT-2026-133640

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update weights endpoint. Attackers can submit a base64-encoded crafted pickle in serialized named tensors, which...

CVE-2026-31048

An issue in the pickle protocol of Pyro v3.x allows attackers to execute arbitrary code via supplying a crafted pickled string message...

PT-2026-24941

Name of the Vulnerable Software and Affected Versions SGLang affected versions not specified Description The SGLang multimodal generation module is susceptible to unauthenticated remote code execution. This occurs through the ZMQ broker, which deserializes untrusted data using the pickle.loads...

PYSEC-2024-167

NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averagedperceptrontagger and punkt...

UBUNTU-CVE-2024-39705

NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averagedperceptrontagger and punkt...

SUSE CVE-2007-5741

Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the 1 statusmessages or 2 linkintegrity module, which the module unpickles and executes...

Google Chrome DoS

Google Chrome browser contains a vulnerability caused by the lack of validation of format values in the ScopedClipboardWriter::WritePickledData function in ui/base/clipboard/scopedclipboardwriter.cc. Exploiting this vulnerability allows malicious actors to cause service failures or otherwise affe...