CVE-2026-10300

LowCVSS 3.7/10Last modified Jul 22, 2026

Description

A security vulnerability has been detected in SGLang 0.5.10.post1. Impacted is an unknown function of the file python/sglang/srt/lora/lora_manager.py of the component Inference HTTP Endpoint. Such manipulation of the argument lora_path leads to reachable assertion. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-617

Affected software

No affected versions have been published.

Timeline

Published: Jun 1, 2026
Last modified: Jul 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1030007.5pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide unusually large alphabetical page-label CVE-2026-1030016.5PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options() method can modify a CVE-2026-1030045.3Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak their return value to pages with diff CVE-2026-1030056.5Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A CVE-2026-1030066.5Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to CVE-2026-1030077.2Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is CVE-2026-1030086.5Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to co CVE-2026-1030097.1Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross CVE-2026-103014.3A vulnerability was detected in itsourcecode Fees Management System 1.0. The affected element is an unknown function of the file index.php. CVE-2026-1030107.8Heap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEncryptor::DecryptFromString) in Progressive Robot hMailServer CVE-2026-1030116.5Heap-based buffer overflow in the legacy Blowfish encryption routine (BlowFishEncryptor::Encode, called by EncryptToString) in Progressive R CVE-2026-1030122.0Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its configuration, ahead