CVE-2026-116172 HIGH 8.2 Vllm — vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter … 2026-10-25 CVE-2026-116173 HIGH 8.2 Vllm — vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to term… 2026-10-25 CVE-2026-116174 HIGH 8.2 Vllm — vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate a… 2026-10-25 CVE-2026-116175 HIGH 7.1 Vllm — vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal… 2026-10-25 CVE-2026-116176 HIGH 8.8 Vllm — vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to … 2026-10-25 CVE-2026-116177 HIGH 8.7 Vllm — vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthe… 2026-10-25 CVE-2026-116178 HIGH 8.2 Vllm — vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to cras… 2026-10-25 CVE-2026-116179 HIGH 8.7 Vllm — vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass … 2026-10-25 CVE-2026-116180 HIGH 8.3 Vllm — vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py … 2026-10-25 CVE-2026-116181 HIGH 7.1 Vllm — vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attacker… 2026-10-25 CVE-2026-114049 MEDIUM 6.3 Vllm — vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to… 2026-10-21 CVE-2026-114050 HIGH 7.1 Vllm — vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check… 2026-10-21 CVE-2026-114051 HIGH 7.1 Vllm — vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null ma… 2026-10-21 CVE-2026-114052 HIGH 8.7 Vllm — vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving tha… 2026-10-21 CVE-2026-114053 CRITICAL 9.2 Vllm — vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers … 2026-10-21 CVE-2026-114054 HIGH 7.1 Vllm — vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shar… 2026-10-21 CVE-2026-114055 HIGH 8.7 Vllm — vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote c… 2026-10-21 CVE-2026-109311 HIGH 7.1 Vllm — vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, ex… 2026-10-12 CVE-2026-105775 MEDIUM 5.3 Vllm — A security vulnerability has been detected in vllm-project vLLM up to 0.31.0. This impacts the function conv_s… 2026-10-06 CVE-2026-105922 MEDIUM 5.3 Vllm — A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin… 2026-10-06 CVE-2026-105752 LOW 3.1 Vllm — vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations… 2026-10-05 CVE-2026-105753 MEDIUM 6.5 Vllm — vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multi… 2026-10-05 CVE-2026-105754 MEDIUM 6.5 Vllm — vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate… 2026-10-05 CVE-2026-105755 MEDIUM 4.2 Vllm — vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction sco… 2026-10-05 CVE-2026-105756 MEDIUM 6.5 Vllm — vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request … 2026-10-05 CVE-2026-105757 MEDIUM 6.5 Vllm — vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request … 2026-10-05 CVE-2026-105758 MEDIUM 5.3 Vllm — vLLM is an inference and serving engine for large language models. From 0.24.0 until 0.30.0, the Qwen2VLVideoB… 2026-10-05 CVE-2026-105759 MEDIUM 5.9 Vllm — vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_… 2026-10-05 CVE-2026-105760 MEDIUM 5.3 Vllm — vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the reque… 2026-10-05 CVE-2026-103241 MEDIUM 6.9 Vllm — A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file r… 2026-09-30 CVE-2026-100647 MEDIUM 6.9 Vllm — vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter accepted on … 2026-09-26 CVE-2026-100648 MEDIUM 6.9 Vllm — vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, a… 2026-09-26 CVE-2026-100649 MEDIUM 6.3 Vllm — vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where s… 2026-09-26 CVE-2026-100650 HIGH 7.1 Vllm — vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented medi… 2026-09-26 CVE-2026-100651 HIGH 7.1 Vllm — vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /in… 2026-09-26 CVE-2026-100652 HIGH 8.2 Vllm — vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and… 2026-09-26 CVE-2026-100653 HIGH 8.3 Vllm — vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the… 2026-09-26 CVE-2026-100654 HIGH 7.1 Vllm — vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and PO… 2026-09-26 CVE-2026-94622 HIGH 8.7 Vllm — vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handli… 2026-09-21 CVE-2026-94623 HIGH 8.7 Vllm — vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implemen… 2026-09-21 CVE-2026-94624 HIGH 8.7 Vllm — vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector i… 2026-09-21 CVE-2026-94625 MEDIUM 6.9 Vllm — vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill r… 2026-09-21 CVE-2026-94626 HIGH 8.7 Vllm — vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible complet… 2026-09-21 CVE-2026-94627 HIGH 8.7 Vllm — vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent c… 2026-09-21 CVE-2026-93989 LOW 2.3 Vllm — vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output w… 2026-09-19 CVE-2026-93592 HIGH 8.7 Vllm — vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling e… 2026-09-18 CVE-2026-93840 MEDIUM 6.3 Vllm — vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width i… 2026-09-18 CVE-2026-93841 MEDIUM 6.3 Vllm — vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt tok… 2026-09-18 CVE-2026-93436 HIGH 8.7 Vllm — vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill… 2026-09-17 CVE-2026-57173 MEDIUM 6.5 Vllm — vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the input_audio handling p… 2026-09-16 CVE-2026-69147 MEDIUM 6.5 Vllm — vLLM is an inference and serving engine for large language models. Prior to 0.28.0, request bodies for Chat Co… 2026-09-16 CVE-2026-92220 MEDIUM 6.9 Vllm — A vulnerability was found in vllm-project vLLM 0.26.0/0.27.0. Affected is the function MoRIIOConnectorSchedule… 2026-09-16 CVE-2026-92365 MEDIUM 5.3 Vllm — A vulnerability was found in vllm-project vllm up to 0.29.0. Affected by this issue is some unknown functional… 2026-09-16 CVE-2026-90878 MEDIUM 5.3 Vllm — A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file /v1… 2026-09-15 CVE-2026-90713 MEDIUM 4.8 Vllm — A security flaw has been discovered in vllm-project vLLM up to 0.29.0. The affected element is the function Ti… 2026-09-14 CVE-2026-90553 HIGH 8.5 Vllm — vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that… 2026-09-12 CVE-2026-90554 MEDIUM 6.9 Vllm — vLLM versions >=0.10.2 and <0.28.0 do not apply any audio decode-size or duration limit when extracting audio … 2026-09-12 CVE-2026-90555 HIGH 7.1 Vllm — vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing… 2026-09-12