vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

vllm-project vLLM Penalty utils.py get_token_bin_counts_and_mask denial of service

vLLM through 0.29.0 Cross-Request Logits Corruption via bad_words

vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds

vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`