VL
Product
vllm
122
CVEs
0
On KEV
9.8
Max CVSS
38
New 30D
Severity mix
Critical 9High 46Medium 62Low 5
Watch
Add vllm to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-114049 | 3.7 | Oct 21 | vLLM before 0.31.0 Stale allowed_token_ids Mask via InputBatch.condense Affected: before 0.31.0 |
| CVE-2026-90713 | 3.3 | Sep 14 | vllm-project vLLM tiktoken vocab File mod.rs new denial of service Affected: 0.1; 0.2; 0.3; 0.4; 0.5; 0.6; +23 more |
| CVE-2026-105752 | 3.1 | Oct 5 | vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle Affected: < 0.30.0 |
| CVE-2025-46570 | 2.6 | May 29 | vLLM’s Chunk-Based Prefix Caching Vulnerable to Potential Timing Side-Channel Affected: < 0.9.0 |
| CVE-2025-25183 | 2.6 | Feb 7 | vLLM using built-in hash() from Python 3.12 leads to predictable hash collisions in vLLM prefix cache Affected: < 0.7.2 |
Showing 5