"##kit ( 0. 12. 0 and prior ) with vision language support. orca security researcher igor stepansky has been credited with discovering and reporting the bug. successful exploitation of the vulnerability could permit an attacker to steal cloud credentials, reach internal services t…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1190Exploit Public-Facing Application
87%
"lmdeploy cve - 2026 - 33626 flaw exploited within 13 hours of disclosure a high - severity security flaw in lmdeploy, an open - source toolkit for compressing, deploying, and serving large language models ( llms ), has come under active exploitation in the wild less than 13 hours…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1190Exploit Public-Facing Application
65%
"score : 9. 8 ) – to upload arbitrary files to susceptible sites, which result in arbitrary code execution and complete takeover. unknown attackers have also been linked to a global campaign targeting internet - exposed, modbus - enabled programmable logic controllers ( plcs ) fro…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1190Exploit Public-Facing Application
50%
"dns exfiltration endpoint, " it said. the actions undertaken by the adversary, detected on apr 22, 2026, at 03 : 35 a. m. utc, unfolded over 10 distinct requests across three phases, with the requests switching between vision language models ( vlms ) such as internlm - xcomposer2…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1190Exploit Public-Facing Application
33%
"attack. " cve - 2026 - 33626 fits a pattern that we have observed repeatedly in the ai - infrastructure space over the past six months : critical vulnerabilities in inference servers, model gateways, and agent orchestration tools are being weaponized within hours of advisory publ…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
Summary
A high-severity security flaw in LMDeploy, an open-source toolkit for compressing, deploying, and serving large language models (LLMs), has come under active exploitation in the wild less than 13 hours after its public disclosure.
The vulnerability, tracked as CVE-2026-33626 (CVSS score: 7.5), relates to a Server-Side Request Forgery (SSRF) vulnerability that could be exploited to access