vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages

vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router

vllm-project vllm OpenAI-compatible Serving Path denial of service

Vllm: vllm: image exif rotation & png trns transparency not normalized, causing mismatch between model input and expectations

vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

vllm-project vLLM Penalty utils.py get_token_bin_counts_and_mask denial of service

vllm-project vLLM Completions Request mamba_mixer2.py conv_ssm_forward out-of-bounds

vLLM through 0.29.0 Cross-Request Logits Corruption via bad_words

vllm-project vllm thinking_budget_state.py algorithmic complexity

vllm-project vLLM Jinja Template Rendering completions resource consumption

vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds

vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`