Ktransformers
Approved changes feed: RSS · Atom
cpe:2.3:a:kvcache-ai:ktransformers:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Kvcache Ai (a1b3dc17-fa2a-56c4-a0b8-ca04dbbc7e78) |
|---|---|
| Product | Ktransformers (cd738b57-5131-5a30-bea4-728fffed764c) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/kvcache-ai/ktransformers |
purl2cpe | 2026-07-28 16:41:09.915942 |
pkg:pypi/ktransformers |
purl2cpe | 2026-07-28 16:41:09.915944 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-63767 |
vulnerable | 2026-07-29 01:06:19.469276 |
ktransformers Unauthenticated Pickle Deserialization RCE via ZMQ
CRITICAL (9.8)
ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle deserialization vulnerability that allows remote attackers to execute arbitrary commands by sending crafted pickle payloads to the SchedulerServer ZMQ ROUTER socket bound to all interfaces. Attackers can exploit malicious __reduce__ methods embedded in crafted pickle payloads to execute arbitrary shell commands as the server process.
Published: 2026-07-20T19:13:43.160Z
Updated: 2026-07-21T12:42:40.500Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-26210 |
vulnerable | 2026-06-08 07:53:21.411814 |
KTransformers Unsafe Deserialization RCE via balance_serve
CRITICAL (9.8)
KTransformers through 0.5.3 contains an unsafe deserialization vulnerability in the balance_serve backend mode where the scheduler RPC server binds a ZMQ ROUTER socket to all interfaces with no authentication and deserializes incoming messages using pickle.loads() without validation. Attackers can send a crafted pickle payload to the exposed ZMQ socket to execute arbitrary code on the server with the privileges of the ktransformers process.
Published: 2026-04-23T21:24:48.641Z
Updated: 2026-11-08T14:01:30.381Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.