CVE-2026-124589

MediumCVSS 6.3/10Last modified Nov 12, 2026

Description

A weakness has been identified in lxtGH OMG-Seg up to f3b26b609bae919760cd3ccf09c36179bb8624a0. This affects the function load_state_dict_into_model of the file omg_llava/xtuner/utils/handle_moe_load_and_save.py of the component MoE Shard Checkpoint Loader. Executing a manipulation of the argument weight_map can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
lxtGH	OMG-Seg	f3b26b609bae919760cd3ccf09c36179bb8624a0

References

Timeline

Published: Nov 9, 2026
Last modified: Nov 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-124596.1Inappropriate implementation in Serial in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to inject arbitrary scripts or HTM CVE-2026-1245907.3A security vulnerability has been detected in zhangbw409 library_manager_system f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b/56514767a5207caf5e0 CVE-2026-1245915.5A vulnerability was detected in Bahleel 0.1.0/0.1.1. Affected is the function fputcsv of the file app/Exporters/CsvExporter.php. The manipul CVE-2026-1245987.5An API key is hardcoded and retrievable from the GV-Face package. Since Android applications can be reverse engineered, embedding sensitive CVE-2026-1245996.2The RSA cryptographic key material, including a private key and public key, is embedded within the application package. Because Android appl CVE-2026-12464.9The ShortPixel Image Optimizer plugin for WordPress is vulnerable to Arbitrary File Read via path traversal in the 'loadFile' parameter in a CVE-2026-124604.2Insufficient policy enforcement in File System Access in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised CVE-2026-12460010.0GV-Face transmits sensitive user credentials and related authentication data over unencrypted HTTP connections. The HTTP traffic is not encr CVE-2026-1246016.2An API key is hardcoded and retrievable from the GV-Access package. Since Android applications can be reverse engineered, embedding sensitiv CVE-2026-1246026.2The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Access application package. Because An CVE-2026-1246036.2An API key is hardcoded and retrievable from the GV-Cloud application package. Since Android applications can be reverse engineered, embeddi CVE-2026-1246046.2The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Cloud application package. Because And