M
Vendor security profile
ModelTC
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs10
Critical6
CISA KEV0
Public exploit8
Patch rate%0
Avg. CVSS8.5
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
0
9
1
CVE KEV
CVE severity distribution
10toplam CVE
Critical6 (60%)
High2 (20%)
Medium2 (20%)
Patch and exploitation view
%0
Verified patch
%0
CISA KEV
%80
Public exploit
0Patch available
0Partial
0Workaround
0Vendor: no patch
10Unknown
Latest vulnerabilities
4.8
CVE-2026-108943
ModelTC LightX2V Tokenizer cosmos3_runner.py AutoTokenizer.from_pretrained code injection
M
Patch status unknownEPSS %0
9.3
CVE-2026-103395
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service
M
Patch status unknownEPSS %1
8.7
CVE-2026-103270
LightLLM through 1.2.0 Missing Authentication on RL Control Routes
M
Patch status unknownEPSS %1
6.9
CVE-2026-103243
LightLLM through 1.2.0 Server-Side Request Forgery via multimodal endpoints
M
Patch status unknownEPSS %0
8.7
CVE-2026-103042
LightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_value
M
Patch status unknownEPSS %1
9.3
CVE-2026-103041
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC Service
M
Patch status unknownEPSS %1
9.3
CVE-2026-103040
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Service
M
Patch status unknownEPSS %1
9.3
CVE-2026-96560
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via NCCL PD RPyC Control Channel
M
Patch status unknownEPSS %1
9.3
CVE-2026-93839
LightLLM through 1.2.0 Missing Authentication in PD Master /pd_register WebSocket Endpoint
M
Patch status unknownEPSS %1
9.3
CVE-2026-90919
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle Deserialization
M
Patch status unknownEPSS %1