Skip to content
Threat Feed
Subscribe

Vendor

Kvcache-Ai

2 briefs RSS
high threat

Authorization Bypass in kvcache-ai Mooncake RPC Path Handler

An authorization bypass vulnerability in the UnmountSegment function of the kvcache-ai mooncake RPC Path Handler allows unauthenticated remote attackers to perform unauthorized operations by manipulating client_id or segment_id arguments.

exploited mooncake vulnerability remote-access rpc
1c
critical advisory

Critical Unauthenticated RCE in ktransformers (CVE-2026-63767)

A critical unauthenticated pickle deserialization vulnerability (CVE-2026-63767) in ktransformers versions up to 0.6.3 allows remote attackers to execute arbitrary commands by sending specially crafted pickle payloads containing malicious `__reduce__` methods to the SchedulerServer ZMQ ROUTER socket, leading to complete server compromise.

ktransformers <= 0.6.3 deserialization remote-code-execution python zmq vulnerability
2r 2t 1c