IT SBIT Services
Schneeberger
DEEN
CVE tracker

New vulnerabilities – clearly explained

Every newly published security vulnerability (CVE), continuously from the NVD, with the actively exploited ones from CISA and the probability of exploitation (EPSS) – each one researched individually: what is affected, what helps, what to do.

4published today
3425in the last 7 days
248of them critical
9newly exploited (7 days)

2 vulnerabilities · Vendor: InternLM

CVE-2026-119706Critical 9.3

InternLM LMDeploy: Unauthenticated remote code execution via pickle deserialization

InternLM LMDeploy versions 0.9.0 through 0.18.0 contain an unsafe deserialization flaw in the /update_weights endpoint of the api_server. An unauthenticated remote attacker can send a crafted, base64-encoded pickle in the serialized_named_tensors field, which is loaded without validation and executes operating system commands as the api_server process. The attack requires only network access to the API server, and the default api_server bind is reachable without authentication.

InternLM · LMDeploy

CVE-2026-105135Critical 9.3

InternLM MindSearch: Code injection in Planner Agent

MindSearch 0.1.0 contains a code injection flaw in the Planner Agent (ExecutionAction.run in mindsearch/agent/graph.py). Manipulated input can lead to code being executed on the server, and the attack can be started remotely. According to the linked exploit description, the POST /solve endpoint can be reached without authentication, so an attacker with network access to the service could run operating system commands with the privileges of the service process. The vendor did not respond to early disclosure, and the exploit is reported as publicly disclosed.

InternLM · MindSearch

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed

Data: NVD (NIST), CISA KEV, FIRST EPSS – updated continuously.