| CVE-2026-94623 |
vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation…
|
8.7
High
|
Sep 21, 2026 |
| CVE-2026-94622 |
vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for…
|
8.7
High
|
Sep 21, 2026 |
| CVE-2026-93989 |
vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in…
|
2.3
Low
|
Sep 19, 2026 |
| CVE-2026-93840 |
vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in…
|
6.3
Medium
|
Sep 18, 2026 |
| CVE-2026-93841 |
vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs…
|
6.3
Medium
|
Sep 18, 2026 |
| CVE-2026-93592 |
vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling…
|
8.7
High
|
Sep 18, 2026 |
| CVE-2026-93436 |
vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode…
|
8.7
High
|
Sep 17, 2026 |
| CVE-2026-69147 |
vLLM is an inference and serving engine for large language models
|
6.5
Medium
|
Sep 16, 2026 |
| CVE-2026-57173 |
vLLM is an inference and serving engine for large language models
|
6.5
Medium
|
Sep 16, 2026 |
| CVE-2026-92365 |
A vulnerability was found in vllm-project vllm up to 0.29.0
|
5.3
Medium
|
Sep 16, 2026 |
| CVE-2026-92220 |
A vulnerability was found in vllm-project vLLM 0.26.0/0.27.0
|
6.9
Medium
|
Sep 16, 2026 |
| CVE-2026-90878 |
A vulnerability was determined in vllm-project vLLM up to 0.27.1
|
5.3
Medium
|
Sep 15, 2026 |
| CVE-2026-90713 |
A security flaw has been discovered in vllm-project vLLM up to 0.29.0
|
4.8
Medium
|
Sep 14, 2026 |
| CVE-2026-90555 |
vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing…
|
7.1
High
|
Sep 12, 2026 |
| CVE-2026-90554 |
vLLM versions >=0.10.2…
|
6.9
Medium
|
Sep 12, 2026 |
| CVE-2026-90553 |
vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores…
|
8.5
High
|
Sep 12, 2026 |
| CVE-2026-78684 |
vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its…
|
6.9
Medium
|
Aug 25, 2026 |
| CVE-2026-73560 |
vLLM is an inference and serving engine for large language models
|
6.5
Medium
|
Aug 17, 2026 |
| CVE-2026-71486 |
vLLM is an inference and serving engine for large language models
|
4.3
Medium
|
Aug 17, 2026 |
| CVE-2026-73559 |
vLLM is an inference and serving engine for large language models
|
6.5
Medium
|
Aug 13, 2026 |
| CVE-2026-73558 |
vLLM is an inference and serving engine for large language models
|
5.3
Medium
|
Aug 13, 2026 |
| CVE-2026-73557 |
vLLM is an inference and serving engine for large language models
|
6.3
Medium
|
Aug 13, 2026 |
| CVE-2026-73556 |
vLLM is an inference and serving engine for large language models
|
5.3
Medium
|
Aug 13, 2026 |
| CVE-2026-73555 |
vLLM is an inference and serving engine for large language models
|
5.3
Medium
|
Aug 13, 2026 |
| CVE-2026-55514 |
vLLM is a library for LLM inference and serving
|
7.1
High
|
Jul 6, 2026 |