VL
Product
vllm
122
CVEs
0
On KEV
9.8
Max CVSS
38
New 30D
Severity mix
Critical 9High 46Medium 62Low 5
Watch
Add vllm to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-115915 New | 9.8 | Oct 26 | vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE Affected: < 0.32.0 |
| CVE-2026-25960 | 9.8 | Mar 9 | SSRF Protection Bypass in vLLM Affected: >= 0.15.1, < 0.17.0 |
| CVE-2026-22778 | 9.8 | Feb 2 | vLLM leaks a heap address when PIL throws an error Affected: >= 0.8.3, < 0.14.1 |
| CVE-2026-22807 | 9.8 | Jan 21 | vLLM affected by RCE via auto_map dynamic module loading during model initialization Affected: >= 0.10.1, < 0.14.0 |
| CVE-2025-47277 | 9.8 | May 20 | vLLM Allows Remote Code Execution via PyNcclPipe Communication Service Affected: >= 0.6.5, < 0.8.5 |
| CVE-2025-32444 | 9.8 | Apr 30 | vLLM Vulnerable to Remote Code Execution via Mooncake Integration Affected: >= 0.6.5, < 0.8.5 |
| CVE-2024-9053 | 9.8 | Mar 20 | Remote Code Execution in vllm-project/vllm Affected: 0.6.0 |
| CVE-2026-48746 | 9.1 | Jun 22 | vLLM: OpenAI auth bypass Affected: >= 0.3.0, < 0.22.0 |
| CVE-2025-29783 | 9.0 | Mar 19 | vLLM Allows Remote Code Execution via Mooncake Integration Affected: >= 0.6.5, < 0.8.0 |
Showing 9