SGLang CVE-2026-5760 (CVSS 9.8) Enables RCE via Malicious GGUF Model Files
2026-04-20T19:24:24Z•2ce3d7e8712e1a303ceb77b7519002cfdc663d2bf1b3a2f82a89cac920c6f8fc
AI‑securityApache‑ActiveMQCISA-KEVCVE-2024-3721CVE-2026-20184CVE-2026-27681CVE-2026-33032CVE-2026-34197CVE-2026-5760CiscoGGUFMiraiOT malwareRCESAPSGLangVercel breachZionSiphonactive exploitationmodel‑supply‑chainn8n abusenginx-ui
What happened
This news digest highlights multiple high‑severity incidents and vulnerabilities. Lead story: SGLang suffers a critical command‑injection vulnerability (CVE-2026-5760, CVSS 9.8) that enables remote code execution via malicious GGUF model files, posing an AI model‑supply‑chain risk. Other notable items include actively exploited and high‑severity flaws in Apache ActiveMQ (CVE-2026-34197) and nginx‑ui (CVE-2026-33032), critical Cisco identity/Webex flaws (CVE-2026-20184), a critical SAP SQL injection (CVE-2026-27681), Mirai/Nexcorium abuse of CVE-2024-3721 in TBK DVRs for botnets, plus multiple
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 2ce3d7e8712e1a303ceb77b7519002cfdc663d2bf1b3a2f82a89cac920c6f8fc
- Enrichment time
- 2026-04-20T19:24:24Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.