76 Total advisories
76 Vulnerabilities
0 Malware
Vulnerabilities
UNKNOWN
CVE-2026-54236
vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router
UNKNOWN
CVE-2026-53923
vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving
UNKNOWN
CVE-2026-54235
vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels
MEDIUM 4.8
CVE-2026-12491
vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations
MEDIUM 6.5
CVE-2026-54233
vLLM: OOM Denial of Service via Audio Decompression Bomb
CRITICAL 9.8
CVE-2024-9052
vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object
CRITICAL 9.8
CVE-2025-47277
vLLM Allows Remote Code Execution via PyNcclPipe Communication Service
CRITICAL 9.8
CVE-2024-11041
vLLM Deserialization of Untrusted Data vulnerability
CRITICAL 9.8
CVE-2026-22778
vLLM has RCE In Video Processing
MEDIUM 5.3
CVE-2026-9540
vllm has Improper Resource Shutdown or Release
CRITICAL 9.8
CVE-2026-22778
vLLM has RCE In Video Processing
CRITICAL 9.8
CVE-2025-47277
vLLM Allows Remote Code Execution via PyNcclPipe Communication Service
CRITICAL 9.8
CVE-2024-9052
vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object
CRITICAL 9.8
CVE-2024-11041
vLLM Deserialization of Untrusted Data vulnerability
HIGH 8.8
CVE-2026-56340
vLLM introduced enhanced protection for CVE-2025-62164
HIGH 7.5
CVE-2026-56340
CVE-2026-56340
CRITICAL 9.1
CVE-2026-48746
vLLM: OpenAI auth bypass
HIGH 8.8
CVE-2026-54232
CVE-2026-54232
CRITICAL 9.1
CVE-2026-48746
CVE-2026-48746
MEDIUM 4.8
GHSA-x8xr-mj9x-6h7w
Duplicate Advisory: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations
HIGH 7.5
CVE-2026-41523
vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution
MEDIUM 6.5
CVE-2026-47155
vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors
UNKNOWN
CVE-2025-48887
CVE-2025-48887
MEDIUM 6.5
CVE-2025-48887
vLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py`
CRITICAL 10.0
CVE-2025-32444
vLLM Vulnerable to Remote Code Execution via Mooncake Integration
CRITICAL 9.8
CVE-2025-32444
CVE-2025-32444
CRITICAL 9.8
CVE-2024-9053
CVE-2024-9053
MEDIUM 6.5
CVE-2026-22773
vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions
MEDIUM 6.5
CVE-2025-29770
vLLM denial of service via outlines unbounded cache on disk
CRITICAL 9.8
CVE-2024-9053
vLLM allows Remote Code Execution by Pickle Deserialization via AsyncEngineRPCServer() RPC server entrypoints
MEDIUM 6.5
CVE-2026-44223
vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters
MEDIUM 6.5
CVE-2026-34755
vLLM: Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing
MEDIUM 5.6
CVE-2026-7141
vLLM makes Use of Uninitialized Resource
MEDIUM 6.5
CVE-2026-44222
vLLM Vulnerable to Remote DoS via Special-Token Placeholders
MEDIUM 6.5
CVE-2026-44223
CVE-2026-44223
MEDIUM 6.5
CVE-2026-34755
CVE-2026-34755
HIGH 7.5
CVE-2026-22773
CVE-2026-22773
MEDIUM 6.5
CVE-2025-29770
CVE-2025-29770
MEDIUM 6.5
CVE-2026-34756
vLLM: Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server
MEDIUM 5.4
CVE-2026-34753
vLLM: Server-Side Request Forgery (SSRF) in `download_bytes_from_url `
HIGH 8.8
CVE-2026-27893
vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out
HIGH 7.1
CVE-2026-24779
vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector
MEDIUM 5.4
CVE-2026-25960
vLLM has SSRF Protection Bypass
HIGH 7.5
CVE-2025-48956
vllm API endpoints vulnerable to Denial of Service Attacks
HIGH 7.5
CVE-2025-30202
Data exposure via ZeroMQ on multi-node vLLM deployment
MEDIUM 6.5
CVE-2025-46560
phi4mm: Quadratic Time Complexity in Input Token Processing leads to denial of service
HIGH 8.8
CVE-2026-22807
vLLM affected by RCE via auto_map dynamic module loading during model initialization
HIGH 7.5
CVE-2025-24357
vllm: Malicious model to RCE by torch.load in hf_model_weights_iterator
HIGH 7.5
CVE-2024-8768
vLLM denial of service vulnerability
HIGH 7.1
CVE-2025-6242
vLLM is vulnerable to Server-Side Request Forgery (SSRF) through `MediaConnector` class
MEDIUM 6.2
CVE-2024-8939
vLLM Denial of Service via the best_of parameter
LOW 2.6
CVE-2025-25183
vLLM uses Python 3.12 built-in hash() which leads to predictable hash collisions in prefix cache
HIGH 8.8
CVE-2025-9141
vLLM has remote code execution vulnerability in the tool call parser for Qwen3-Coder
LOW 2.6
CVE-2025-46570
Potential Timing Side-Channel Vulnerability in vLLM’s Chunk-Based Prefix Caching
HIGH 8.0
CVE-2025-30165
Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration
MEDIUM 4.3
GHSA-j828-28rj-hfhp
vLLM vulnerable to Regular Expression Denial of Service
MEDIUM 6.5
CVE-2025-62426
vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs`
HIGH 8.8
CVE-2025-62164
vLLM deserialization vulnerability leading to DoS and potential RCE
MEDIUM 4.2
CVE-2025-46722
vLLM has a Weakness in MultiModalHasher Image Hashing Implementation
MEDIUM 6.5
CVE-2025-48943
vLLM allows clients to crash the openai server with invalid regex
HIGH 7.5
CVE-2025-59425
vLLM is vulnerable to timing attack at bearer auth
MEDIUM 6.5
CVE-2025-48944
vLLM Tool Schema allows DoS via Malformed pattern and type Fields
CRITICAL 9.0
CVE-2025-29783
vLLM Allows Remote Code Execution via Mooncake Integration
CRITICAL 9.8
GHSA-ggpf-24jw-3fcw
CVE-2025-24357 Malicious model remote code execution fix bypass with PyTorch < 2.6.0
MEDIUM 6.5
CVE-2025-62372
vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs
MEDIUM 6.5
CVE-2025-61620
vLLM: Resource-Exhaustion (DoS) through Malicious Jinja Template in OpenAI-Compatible Server
MEDIUM 6.5
CVE-2025-48942
vLLM DOS: Remotely kill vllm over http with invalid JSON schema
HIGH 7.1
CVE-2025-66448
vLLM vulnerable to remote code execution via transformers_utils/get_config
UNKNOWN
CVE-2025-29783
CVE-2025-29783
UNKNOWN
CVE-2025-25183
CVE-2025-25183
HIGH 8.8
CVE-2025-24357
CVE-2025-24357
UNKNOWN
CVE-2025-46570
CVE-2025-46570
UNKNOWN
CVE-2025-48943
CVE-2025-48943
UNKNOWN
CVE-2025-48942
CVE-2025-48942
UNKNOWN
CVE-2025-46722
CVE-2025-46722
MEDIUM 6.5
GHSA-hf3c-wxg2-49q9
vLLM vulnerable to Denial of Service by abusing xgrammar cache
Ready to move
Start Securing
Free, no credit card | First findings in minutes