These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-30T19:17:08.793Z and has not been modified since then. CVE-2026-15976 is a critical remote code execution vulnerability in SGLang, specifically within the /update_weights_from_disk function where torch.load(..., weights_only=False) enables pickle deserialization of .bin files. This vulnerability has [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-30T19:17:08.697Z and has not been modified since then. This CVE record indicates a Server-Side Request Forgery (SSRF) and local file read vulnerability in the SGLang project, specifically in the multimodal generation endpoint /v1/chat/completions. The vulnerability is due to unsanitized user input i [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-30T19:17:08.590Z and has not been modified since then. SGLang library contains a remote code execution vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPER_SERVER_PORT is set, enabling code execution on inference requests. This critical vulnerability [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-30T19:17:08.450Z and has not been modified since then. SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads. This vulnerability affects SGLang d [truncated]
CVE-2026-14890 is a critical vulnerability in SGLang's expert-parallel backup subsystem. The subsystem exposes a ZeroMQ PULL socket on a routable network interface without authentication or deserialization safeguards. This allows an attacker to provide a malicious pickle file, resulting in unauthenticated remote code execution when the feature is enabled and the service is reachable over the network. Orga [truncated]
CVE-2026-7302 is an unauthenticated path traversal issue reported for SGLang’s multimodal generation runtime. The flaw can let an attacker place files outside the intended upload path by using ../ sequences in an upload filename, potentially writing anywhere the server process has permission to write. Because the issue is unauthenticated and impacts file integrity on the host, it deserves prompt review ev [truncated]
SGLang's multimodal generation runtime scheduler exposes a ROUTER socket that binds to 0.0.0.0 by default and deserializes incoming messages using pickle.loads(), enabling unauthenticated remote code execution when the service is internet-facing. The vulnerability stems from unsafe deserialization (CWE-502) combined with a permissive network binding, allowing attackers to send crafted pickle payloads that [truncated]