These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-90919 is a critical remote code execution vulnerability in LightLLM's Config Server. The vulnerability exists in the unauthenticated /visual_register WebSocket endpoint, which passes client frames directly to pickle.loads(). This allows attackers to execute arbitrary code with Config Server process privileges by sending a malicious serialized payload with a __reduce__ method.
CVE-2026-26220 is a critical vulnerability in LightLLM version 1.1.0 and prior. The vulnerability allows unauthenticated remote code execution in PD disaggregation mode. The PD master node exposes WebSocket endpoints that receive binary frames and pass the data directly to pickle.loads() without authentication or validation. A remote attacker who can reach the PD master can send a crafted payload to achie [truncated]