Thursday, April 23, 2026 · 3 of 5

1. CVE-2026-5760 SGLang (CVSS 9.8) — RCE via malicious GGUF model file

   Unsandboxed Jinja2 rendering in the /v1/rerank endpoint; any team loading models from Hugging Face into SGLang should patch immediately.

   Apr 20