VL
Product
vllm
112
CVEs
0
On KEV
9.8
Max CVSS
29
New 30D
Severity mix
Critical 9High 45Medium 55Low 3
Watch
Add vllm to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-115915 New | 9.8 | Oct 26 | vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE Affected: 0.30.0 before 0.32.0 |
| CVE-2026-25960 | 9.8 | Mar 9 | SSRF Protection Bypass in vLLM Affected: 0.15.1 before 0.17.0 |
| CVE-2026-22778 | 9.8 | Feb 2 | vLLM leaks a heap address when PIL throws an error Affected: 0.8.3 before 0.14.1 |
| CVE-2026-22807 | 9.8 | Jan 21 | vLLM affected by RCE via auto_map dynamic module loading during model initialization Affected: 0.10.1 before 0.14.0 |
| CVE-2025-47277 | 9.8 | May 20 | vLLM Allows Remote Code Execution via PyNcclPipe Communication Service Affected: 0.6.5 before 0.8.5 |
| CVE-2025-32444 | 9.8 | Apr 30 | vLLM Vulnerable to Remote Code Execution via Mooncake Integration Affected: 0.6.5 before 0.8.5 |
| CVE-2024-11041 | 9.8 | Mar 20 | Remote Code Execution in vllm-project/vllm Affected: 0.6.2 |
| CVE-2026-48746 | 9.1 | Jun 22 | vLLM: OpenAI auth bypass Affected: 0.3.0 before 0.22.0 |
| CVE-2025-29783 | 9.0 | Mar 19 | vLLM Allows Remote Code Execution via Mooncake Integration Affected: 0.6.5 before 0.8.0 |
Showing 9