Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 01:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

136-77% vs 7-day avg of 597

2 critical, 34 high, 59 medium, 21 low

Expand	Severity	Score	Advisory	Title	Source	Flags	Published
	High	8.8	CVE-2026-116176	vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the... vllm-project, Vllmvllm-project vllm, vLLM, Vllm P2pNcclConnector	NVD		Oct 25 14:16 UTC
CVE-2026-116176vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the... Executive summary The advisory says vLLM versions from 0.9.2 before 0.24.0 contain a server-side request forgery flaw that lets an API caller make the server open outbound connections and leak key-value cache data from requests processed by a prefill worker using the P2pNcclConnector. It is rated High severity. The recommended fix is to upgrade to vLLM 0.24.0, which removes the affected connector. Technical summary The flaw is classified as CWE-918 server-side request forgery. The OpenAIServing._base_request_id function copies the X-Request-Id HTTP header into the request_id without validation, and P2pNcclConnector.parse_request_id extracts an arbitrary host and port from it using a permissive regex, letting the caller force outbound ZMQ connections and NCCL communicator setup to an attacker-chosen host. The advisory states the affected range as >= 0.9.2, < 0.24.0 when using P2pNcclConnector, with the patched version 0.24.0. The precondition is a prefill worker configured with a kv_producer role and the P2pNcclConnector, and a valid API key or no key if --api-key is unset. PR #44854 removed the affected connector, and the advisory also describes a proposed fix of stripping the header and adding a CIDR or hostname allow-list. The advisory does not state any detection guidance or exploitation in the wild, and no CVSS score is stated beyond the High severity rating. No CVE identifier is given (it says 'No known CVE'). Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/vllm-project/vllm/security/advisories/GHSA-vfp2-c8pq-v6h6 Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM Vllm P2pNcclConnector NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer