# ModelTC vulnerabilities Source: https://junglewise.ai/threats/vendors/modeltc Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/modeltc.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 12 vulnerabilities in ModelTC: 0 in the last 7 days and 11 in the last 90 days, 6 of them critical and 0 exploited in the wild. The most recent, CVE-2026-111160, was published on 15 October 2026. 2 vulnerabilities in the last four weeks, down 78% on the four before (9). 0 critical against 6. 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 11 - All time: 12 (6 critical, 0 exploited in the wild) ## About ModelTC ModelTC is an organization focused on developing tools for deep learning model deployment and quantization. ## Latest ModelTC vulnerabilities - [CVE-2026-111160: LightLLM denial of service via pd_kv_trans_params unpickling](https://junglewise.ai/threats/cve-2026-111160-lightllm-through-1-2-0-contains-a-denial-of-service) (high, CVSS 7.5, published 15 Oct 2026) - [CVE-2026-108943: ModelTC LightX2V code injection in tokenizer loader](https://junglewise.ai/threats/cve-2026-108943-a-weakness-has-been-identified-in-modeltc-lightx2v-up-to-0-5-0) (medium, CVSS 5.3, published 13 Oct 2026) - [CVE-2026-103395: LightLLM visual_only unauthenticated RCE via RPyC pickle deserialization](https://junglewise.ai/threats/cve-2026-103395-lightllm-through-1-2-0-visual-only-deployments-expose-an) (critical, CVSS 9.8, published 30 Sep 2026) - [CVE-2026-103270: LightLLM authentication bypass in reinforcement learning control API](https://junglewise.ai/threats/cve-2026-103270-lightllm-through-1-2-0-mounts-reinforcement-learning-control) (high, CVSS 7.5, published 30 Sep 2026) - [CVE-2026-103243: LightLLM server-side request forgery in multimodal endpoints](https://junglewise.ai/threats/cve-2026-103243-lightllm-through-1-2-0-fails-to-validate-image-url-and-audio-url) (medium, CVSS 5.8, published 30 Sep 2026) - [CVE-2026-103042: LightLLM memory exhaustion in NCCL control channel](https://junglewise.ai/threats/cve-2026-103042-lightllm-through-1-2-0-contains-a-memory-exhaustion) (high, CVSS 7.5, published 29 Sep 2026) - [CVE-2026-103041: LightLLM multimodal pickle deserialization in RPyC cache service](https://junglewise.ai/threats/cve-2026-103041-lightllm-through-1-2-0-multimodal-deployments-expose-an) (critical, CVSS 9.8, published 29 Sep 2026) - [CVE-2026-103040: LightLLM remote code execution in router profiler service](https://junglewise.ai/threats/cve-2026-103040-lightllm-through-1-2-0-contains-a-remote-code-execution) (critical, CVSS 9.8, published 29 Sep 2026) - [CVE-2026-96560: LightLLM KV-transfer worker remote code execution in NCCL mode](https://junglewise.ai/threats/cve-2026-96560-lightllm-through-1-2-0-contains-a-remote-code-execution) (critical, CVSS 9.8, published 23 Sep 2026) - [CVE-2026-93839: LightLLM authentication bypass in /pd_register WebSocket endpoint](https://junglewise.ai/threats/cve-2026-93839-lightllm-through-1-2-0-contains-an-authentication-bypass) (critical, CVSS 9.8, published 18 Sep 2026) - [CVE-2026-90919: LightLLM Config Server unsafe pickle deserialization in /visual_register](https://junglewise.ai/threats/cve-2026-90919-lightllm-config-server-unsafe-pickle-deserialization-in-visual) (critical, CVSS 9.8, published 14 Sep 2026) - [CVE-2026-26220: ModelTC LightLLM remote code execution in PD WebSocket endpoints](https://junglewise.ai/threats/cve-2026-26220-modeltc-lightllm-remote-code-execution-in-pd-websocket-endpoints) (info, CVSS 9.3, published 17 Feb 2026) ## Most severe ModelTC vulnerabilities - [CVE-2026-90919: LightLLM Config Server unsafe pickle deserialization in /visual_register](https://junglewise.ai/threats/cve-2026-90919-lightllm-config-server-unsafe-pickle-deserialization-in-visual) (critical, CVSS 9.8, published 14 Sep 2026) - [CVE-2026-93839: LightLLM authentication bypass in /pd_register WebSocket endpoint](https://junglewise.ai/threats/cve-2026-93839-lightllm-through-1-2-0-contains-an-authentication-bypass) (critical, CVSS 9.8, published 18 Sep 2026) - [CVE-2026-96560: LightLLM KV-transfer worker remote code execution in NCCL mode](https://junglewise.ai/threats/cve-2026-96560-lightllm-through-1-2-0-contains-a-remote-code-execution) (critical, CVSS 9.8, published 23 Sep 2026) - [CVE-2026-103395: LightLLM visual_only unauthenticated RCE via RPyC pickle deserialization](https://junglewise.ai/threats/cve-2026-103395-lightllm-through-1-2-0-visual-only-deployments-expose-an) (critical, CVSS 9.8, published 30 Sep 2026) - [CVE-2026-103041: LightLLM multimodal pickle deserialization in RPyC cache service](https://junglewise.ai/threats/cve-2026-103041-lightllm-through-1-2-0-multimodal-deployments-expose-an) (critical, CVSS 9.8, published 29 Sep 2026) - [CVE-2026-103040: LightLLM remote code execution in router profiler service](https://junglewise.ai/threats/cve-2026-103040-lightllm-through-1-2-0-contains-a-remote-code-execution) (critical, CVSS 9.8, published 29 Sep 2026) - [CVE-2026-111160: LightLLM denial of service via pd_kv_trans_params unpickling](https://junglewise.ai/threats/cve-2026-111160-lightllm-through-1-2-0-contains-a-denial-of-service) (high, CVSS 7.5, published 15 Oct 2026) - [CVE-2026-103270: LightLLM authentication bypass in reinforcement learning control API](https://junglewise.ai/threats/cve-2026-103270-lightllm-through-1-2-0-mounts-reinforcement-learning-control) (high, CVSS 7.5, published 30 Sep 2026) - [CVE-2026-103042: LightLLM memory exhaustion in NCCL control channel](https://junglewise.ai/threats/cve-2026-103042-lightllm-through-1-2-0-contains-a-memory-exhaustion) (high, CVSS 7.5, published 29 Sep 2026) - [CVE-2026-103243: LightLLM server-side request forgery in multimodal endpoints](https://junglewise.ai/threats/cve-2026-103243-lightllm-through-1-2-0-fails-to-validate-image-url-and-audio-url) (medium, CVSS 5.8, published 30 Sep 2026) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, down 78% on the four before (9). 0 critical against 6. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 2 | 2 | 0 | | 21 Sep 2026 | 1 | 1 | 0 | | 28 Sep 2026 | 6 | 3 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 2 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## ModelTC technologies - [ModelTC LightLLM](https://junglewise.ai/threats/technologies/lightllm): 11 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "ModelTC vulnerabilities", https://junglewise.ai/threats/vendors/modeltc, 12 November 2026.