https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 20:55:17 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-86793 <p>SGLang allows unauthenticated pickle deserialization through /update_weights_from_tensor when no auth keys are configured, and the SafeUnpickler policy can be bypassed because builtins.import and builtins.getattr are resolvable, enabling code execution via pickle REDUCE.</p> <p>SGLang allows unauthenticated pickle deserialization through /update_weights_from_tensor when no auth keys are configured, and the SafeUnpickler policy can be bypassed because builtins.import and builtins.getattr are resolvable, enabling code execution via pickle REDUCE.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-86793 https://vulnerability.circl.lu/vuln/ghsa-m675-99qc-9233 <p>SGLang allows unauthenticated pickle deserialization through /update_weights_from_tensor when no auth keys are configured, and the SafeUnpickler policy can be bypassed because builtins.import and builtins.getattr are resolvable, enabling code execution via pickle REDUCE.</p> <p>SGLang allows unauthenticated pickle deserialization through /update_weights_from_tensor when no auth keys are configured, and the SafeUnpickler policy can be bypassed because builtins.import and builtins.getattr are resolvable, enabling code execution via pickle REDUCE.</p> https://vulnerability.circl.lu/vuln/ghsa-m675-99qc-9233 https://vulnerability.circl.lu/vuln/opensuse-su-2026:11865-1 <p>python313-sglang-0.5.20-1.1 on GA media</p> <p>python313-sglang-0.5.20-1.1 on GA media</p> https://vulnerability.circl.lu/vuln/opensuse-su-2026:11865-1