VL
Product
vllm
106
CVEs
0
On KEV
9.8
Max CVSS
38
New 30D
Severity mix
Critical 6High 40Medium 57Low 3
Watch
Add vllm to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-115915 New | 9.8 | Oct 26 | vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE Affected: < 0.32.0 |
| CVE-2026-25960 | 9.8 | Mar 9 | SSRF Protection Bypass in vLLM Affected: >= 0.15.1, < 0.17.0 |
| CVE-2026-22778 | 9.8 | Feb 2 | vLLM leaks a heap address when PIL throws an error Affected: >= 0.8.3, < 0.14.1 |
| CVE-2026-22807 | 9.8 | Jan 21 | vLLM affected by RCE via auto_map dynamic module loading during model initialization Affected: >= 0.10.1, < 0.14.0 |
| CVE-2024-9053 | 9.8 | Mar 20 | vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer() RPC server entrypoints Affected: 0.6.0 |
| CVE-2026-48746 | 9.1 | Jun 22 | vLLM: OpenAI auth bypass Affected: >= 0.3.0, < 0.22.0 |
Showing 6