https://vulnerability.circl.lu/sightings/feed 2026-09-17T11:33:22.431652+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/0e3e9682-7a4a-413e-a03b-a436ced32507/export 2026-09-17T11:33:22.440668+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "0e3e9682-7a4a-413e-a03b-a436ced32507", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59287", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-16)", "content": "", "creation_timestamp": "2026-09-17T10:00:07.892076Z"} 2026-09-17T10:00:07.892076+00:00 https://vulnerability.circl.lu/sighting/895e0f16-adab-4d4a-9d0a-58f34809db38/export 2026-09-17T11:33:22.442726+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "895e0f16-adab-4d4a-9d0a-58f34809db38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59953", "type": "seen", "source": "https://gist.github.com/alon710/efe1b2090e21bb0a7cf5f18ce00c2614", "content": "# CVE-2025-59953: CVE-2025-59953: Unauthenticated Remote Code Execution in LMDeploy AsyncRPCServer via Insecure Pickle Deserialization\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2025-59953\n\n## Summary\nLMDeploy prior to version 0.10.2 is vulnerable to remote code execution because its AsyncRPCServer component implements unauthenticated, remote-accessible communication sockets and uses the insecure pickle.loads() deserializer to process incoming requests.\n\n## TL;DR\nUnauthenticated remote attackers can execute arbitrary code on LMDeploy hosts prior to v0.10.2 by sending a malicious Python pickle stream to the dynamically opened ZMQ RPC port.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-502\n- **Attack Vector**: Network\n- **Complexity**: Low\n- **Privileges Required**: None\n- **EPSS Score**: N/A\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- lmdeploy\n- **lmdeploy**: >= 0.9.1, < 0.10.2 (Fixed in: `0.10.2`)\n\n## Mitigation\n\n- Upgrade LMDeploy to 0.10.2 or higher\n- Implement firewall rules to block high random ports\n- Use local container network namespaces without host networking\n- Run services under a non-root low-privileged user account\n\n**Remediation Steps:**\n1. Run pip install --upgrade lmdeploy\n2. Verify local binding in zmq_rpc.py is localhost\n3. Establish micro-segmentation rules on model server host nodes\n\n## References\n\n- [GitHub Security Advisory GHSA-5h8j-6crg-7rmw](https://github.com/InternLM/lmdeploy/security/advisories/GHSA-5h8j-6crg-7rmw)\n- [Commit d86046a0e6b02ecaaf7cdb74346d0477130221c2](https://github.com/InternLM/lmdeploy/commit/d86046a0e6b02ecaaf7cdb74346d0477130221c2)\n- [LMDeploy v0.10.2 Release](https://github.com/InternLM/lmdeploy/releases/tag/v0.10.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2025-59953) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-16T18:31:42.521113Z"} 2026-09-16T18:31:42.521113+00:00 https://vulnerability.circl.lu/sighting/04c20391-7b60-4cda-a9c3-4395648b4f8b/export 2026-09-17T11:33:22.442897+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "04c20391-7b60-4cda-a9c3-4395648b4f8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59953", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvnqvpl4ba2b", "content": "CVE-2025-59953 - lmdeploy\nThe LMdeploy software includes an RPC server that accepts messages and deserializes them without checking their content. An attacker who can send a specially crafted message\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#lmdeploy #internlm #pip #CVE #infosec", "creation_timestamp": "2026-09-16T18:20:05.843424Z"} 2026-09-16T18:20:05.843424+00:00 https://vulnerability.circl.lu/sighting/1223e08a-f52d-4c7a-abb4-365f250e7cc0/export 2026-09-17T11:33:22.443021+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "1223e08a-f52d-4c7a-abb4-365f250e7cc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59953", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvnq7qjmsm25", "content": "\ud83d\udea8 CVE-2025-59953 \u2014 CVSS 9.8 CRITICAL\n\nLMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0....\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2025-59953\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-16T18:07:47.772136Z"} 2026-09-16T18:07:47.772136+00:00 https://vulnerability.circl.lu/sighting/f18edfe9-6618-4c54-a490-73892741de80/export 2026-09-17T11:33:22.443120+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "f18edfe9-6618-4c54-a490-73892741de80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59953", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/cfid76vzr44xo", "content": "CVE-2025-59953 - LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy\nCVE ID : CVE-2025-59953\n \n Published : Sept. 16, 2026, 3:36 p.m. | 9\u00a0minutes ago\n \n Description : LMDeploy is a toolkit for compressing, deploying,...", "creation_timestamp": "2026-09-16T17:20:31.991608Z"} 2026-09-16T17:20:31.991608+00:00 https://vulnerability.circl.lu/sighting/4e890b4e-1e4e-43d2-b274-cfb49e2f2f9f/export 2026-09-17T11:33:22.443233+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "4e890b4e-1e4e-43d2-b274-cfb49e2f2f9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2025-59953", "type": "published-proof-of-concept", "source": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-5h8j-6crg-7rmw", "content": "", "creation_timestamp": "2026-09-16T16:35:02.155197Z"} 2026-09-16T16:35:02.155197+00:00 https://vulnerability.circl.lu/sighting/0450d4a9-8c8e-491f-81eb-ec9cee041ce1/export 2026-09-17T11:33:22.444924+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "0450d4a9-8c8e-491f-81eb-ec9cee041ce1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59287", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-14)", "content": "", "creation_timestamp": "2026-09-15T10:00:10.488224Z"} 2026-09-15T10:00:10.488224+00:00 https://vulnerability.circl.lu/sighting/9d40d17b-e4ef-486f-8f7b-443eab1e9f08/export 2026-09-17T11:33:22.445072+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "9d40d17b-e4ef-486f-8f7b-443eab1e9f08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59287", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-13)", "content": "", "creation_timestamp": "2026-09-14T10:00:06.150532Z"} 2026-09-14T10:00:06.150532+00:00 https://vulnerability.circl.lu/sighting/9b401603-3e42-4e47-a01c-b873bc7fcf54/export 2026-09-17T11:33:22.445201+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "9b401603-3e42-4e47-a01c-b873bc7fcf54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59287", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mvhjwehwaz2n", "content": "Top 3 CVE for last 7 days:\nCVE-2026-85046: 26 interactions\nCVE-2026-85880: 22 interactions\nCVE-2026-20079: 20 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-51990: 7 interactions\nCVE-2026-90561: 4 interactions\nCVE-2025-59287: 3 interactions\n", "creation_timestamp": "2026-09-14T06:59:12.820193Z"} 2026-09-14T06:59:12.820193+00:00 https://vulnerability.circl.lu/sighting/d1d263b1-cc28-4716-9e06-b335fc75f852/export 2026-09-17T11:33:22.445306+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "d1d263b1-cc28-4716-9e06-b335fc75f852", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59287", "type": "seen", "source": "https://bsky.app/profile/luahai.bsky.social/post/3mvfrvi3wcs2u", "content": "Most AI tools hallucinate CVEs and give you broken exploits with total confidence. I asked Luah AI to research a critical vulnerability and generate a working PoC. This is what it returned, still early, but the self-checking part is interesting. (CVE-2025-59287) #AI #Cyber #Hacking", "creation_timestamp": "2026-09-13T14:16:38.454545Z"} 2026-09-13T14:16:38.454545+00:00