Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 02:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

144-76% vs 7-day avg of 597

2 critical, 38 high, 59 medium, 25 low

Expand	Severity	Score	Advisory	Title	Source	Published
	High	7.1	CVE-2026-116181	vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stop_token_ids vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 25 14:16 UTC
CVE-2026-116181vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stop_token_ids Executive summary The advisory says vLLM versions from 0.20.1 before 0.29.0 contain a flaw in which a single crafted request with an out-of-vocabulary stop token ID can crash the inference engine and interrupt service for other users. The advisory rates the issue Moderate with a CVSS v3.1 base score of 6.5, and the fix is to upgrade to 0.29.0 or later. Technical summary The weakness is improper input validation (CWE-129, with related CWE-248, CWE-400 and CWE-787) in stop_token_ids, which were checked only to be integers and not against the model vocabulary. A remote attacker who can send OpenAI chat or completion requests, or the legacy generate endpoint, with an out-of-vocabulary ID can trigger an assertion and terminate the engine on the default V1 runner, or write outside the logits buffer on the V2 runner. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, so low privileges are required. Affected versions are stated as greater than or equal to 0.20.1 and less than 0.29.0, and the patched version is stated as 0.29.0, with the fix in PR #54196 that rejects invalid IDs as request errors. The advisory does not state any workaround, and it gives no detection guidance or information about exploitation in the wild. No CVE identifier is listed (it states 'No known CVE'). Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/vllm-project/vllm/security/advisories/GHSA-w9r6-29q4-pvpr Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.3	CVE-2026-116180	vLLM from 0.8.5 before 0.31.0 has a denial of service flaw vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 25 14:16 UTC
CVE-2026-116180vLLM from 0.8.5 before 0.31.0 has a denial of service flaw Executive summary The advisory says vLLM versions from 0.8.5 before 0.31.0 contain a denial of service flaw. A single crafted API request using prompt_logprobs against a connector-cached prefix can crash the engine process, dropping all in-flight requests from other users on that engine. The advisory rates it High (7.7 CVSS as stated), and the patch replaces uninitialized memory with zero and negative infinity defaults; the advisory states the fix has not landed upstream yet. Technical summary The flaw is classed as use of uninitialized resource (CWE-908) leading to uncontrolled resource consumption (CWE-400) in LogprobsTensors.empty_cpu() in vllm/v1/outputs.py, which uses torch.empty(). Exploitation requires the V1 engine with a KVConnectorBase_V1 subclass that reports externally computed tokens, plus a request with prompt_logprobs (or logprobs with echo=true); the advisory lists network attack vector, low complexity, and low privileges. The proposed patch uses torch.zeros() and torch.full(-inf), and the advisory says a Fixes trailer should reference commit 3aee6573dc58. Workarounds stated are disabling KV connectors, stripping prompt_logprobs, logprobs and echo at a gateway, or applying the patch. The advisory lists affected versions as v0.8.5 onward through HEAD, and the patched version is written as >= 0.31.0. Detection guidance is not stated, and whether the fix has been released in a tagged version beyond the advisory's note that main is still affected is not stated beyond that. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: PyPI vllm Summarized from https://github.com/vllm-project/vllm/security/advisories/GHSA-rhcx-5729-88vg Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.7	CVE-2026-116179	vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through... vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 25 14:16 UTC
CVE-2026-116179vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through... Executive summary A flaw in vLLM, an open-source system for serving large language models, lets API clients bypass a frame-count limit on inline video uploads. The advisory says it can cause excessive memory and CPU use and can crash or OOM-kill the serving process, and it is rated High. The fix rejects per-request media decoder overrides by default, and the advisory says deployments should update to version 0.31.0 or later. Technical summary The weakness is CWE-770, allocation of resources without limits or throttling, in VideoMediaIO.load_base64 for video/jpeg input. A client that can call the chat endpoint can set media_io_kwargs.video num_frames to -1 or a very large value, which bypasses the frame cap and makes the API frontend decode and stack every frame in memory. Affected versions are stated as 0.18.0 up to but not including 0.31.0, and the patched version is stated as 0.31.0 or later; the advisory notes the issue was confirmed on 0.19.1. The fix is PR #58830, which rejects non-empty per-request media_io_kwargs by default, and deployments that trust their clients can opt in with --trust-request-mm-kwargs. The advisory does not state a CVSS score, a CVE assignment beyond 'No known CVE', any workaround beyond the flag described, exploitation in the wild, or specific detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/vllm-project/vllm/security/advisories/GHSA-4m6g-h9mv-wqjc Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.2	CVE-2026-116178	vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the... vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 25 14:16 UTC
CVE-2026-116178vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the... Executive summary A denial of service flaw in vLLM, an open-source engine for running large language models, lets a remote attacker crash the engine by sending crafted multimodal request data. The advisory rates it Moderate with a CVSS v3.1 base score of 5.9, and says the fix is to upgrade to vLLM version 0.30.0 or later. Technical summary The flaw is improper input validation (CWE-20) in the disaggregated multimodal /inference/v1/generate endpoint, which accepted client-supplied kwargs_data, mm_hashes, and mm_placeholders without checking that they describe a consistent prompt layout. Overlapping or repeated placeholder ranges can reach model code and crash the engine, as reproduced with Qwen2.5-VL-3B-Instruct. Affected versions are stated as greater than or equal to 0.20.0 and less than 0.30.0, and the patched version is stated as greater than or equal to 0.30.0, with the fix in PR #51898. The CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, requiring no privileges or user interaction. No workaround is stated, no CVE ID is assigned, and no detection guidance or evidence of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/vllm-project/vllm/security/advisories/GHSA-34qw-q2h2-jp3m Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.7	CVE-2026-116177	vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL... vllm-project, Vllm, Pillowvllm-project vllm, vLLM, Pillow	NVD	Oct 25 14:16 UTC
CVE-2026-116177vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL... Executive summary vLLM, an open-source system for serving large language models, has a flaw in its Nemotron-VL image processors that lets an unauthenticated remote user exhaust server memory and deny service to other users on the same instance. The advisory rates the issue High, and the fix is to upgrade to vLLM 0.25.0 or later. Technical summary The weakness is CWE-400, uncontrolled resource consumption. Two Nemotron-VL processor modules set Pillow's Image.MAX_IMAGE_PIXELS to None at import time, which disables Pillow's decompression-bomb guard for the whole process. An unauthenticated caller who can reach /v1/chat/completions on an instance that has imported either processor can submit a crafted image that decompresses to a very large size, potentially causing the worker to be killed by the out-of-memory handler. Affected versions are listed as 0.10.2 before 0.25.0 in the NVD description and as <= 0.8.5 in the GitHub advisory, which the advisory does not reconcile; the patched version is stated as 0.25.0 or later. The fix in PR #47010 removes the module-level assignments and adds a decoded pixel-count limit configurable through VLLM_MAX_IMAGE_PIXELS. No workaround beyond upgrading is stated, and no detection guidance is stated. No CVSS score is stated, and the advisory gives severity as High. No known CVE ID is listed in the GitHub text, and exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/vllm-project/vllm/security/advisories/GHSA-mm38-5g96-7j6x Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm Pillow vllm-project vllm vLLM Pillow NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.8	CVE-2026-116176	vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the... vllm-project, Vllmvllm-project vllm, vLLM, Vllm P2pNcclConnector	NVD	Oct 25 14:16 UTC
CVE-2026-116176vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the... Executive summary The advisory says vLLM versions from 0.9.2 before 0.24.0 contain a server-side request forgery flaw that lets an API caller make the server open outbound connections and leak key-value cache data from requests processed by a prefill worker using the P2pNcclConnector. It is rated High severity. The recommended fix is to upgrade to vLLM 0.24.0, which removes the affected connector. Technical summary The flaw is classified as CWE-918 server-side request forgery. The OpenAIServing._base_request_id function copies the X-Request-Id HTTP header into the request_id without validation, and P2pNcclConnector.parse_request_id extracts an arbitrary host and port from it using a permissive regex, letting the caller force outbound ZMQ connections and NCCL communicator setup to an attacker-chosen host. The advisory states the affected range as >= 0.9.2, < 0.24.0 when using P2pNcclConnector, with the patched version 0.24.0. The precondition is a prefill worker configured with a kv_producer role and the P2pNcclConnector, and a valid API key or no key if --api-key is unset. PR #44854 removed the affected connector, and the advisory also describes a proposed fix of stripping the header and adding a CIDR or hostname allow-list. The advisory does not state any detection guidance or exploitation in the wild, and no CVSS score is stated beyond the High severity rating. No CVE identifier is given (it says 'No known CVE'). Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/vllm-project/vllm/security/advisories/GHSA-vfp2-c8pq-v6h6 Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM Vllm P2pNcclConnector NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	7.1	CVE-2026-116175	vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s decoded-duration... vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 25 14:16 UTC
CVE-2026-116175vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s decoded-duration... Executive summary The vLLM inference server, versions from 0.19.0 before 0.24.0, is affected by a decompression bomb flaw in its chat audio input handling. A remote user who can send chat completion requests can submit a small compressed audio file that expands into a very large decoded output, which can exhaust memory or degrade availability. The advisory rates it Moderate with a CVSS 3.1 base score of 6.5, and the recommended remedy is upgrading to vLLM 0.24.0. Technical summary The weakness is CWE-409, improper handling of highly compressed data, in the multimodal AudioMediaIO path used by /v1/chat/completions for input_audio data URLs and audio_url media. The decoder duration guard added for speech-to-text is not passed through this path, so load_audio is called without a max_duration_s bound. The attack vector is network, with low attack complexity and low privileges required (PR:L), and the advisory notes that PR:N may apply if chat completions lack API-key authentication. Affected versions are stated as >= 0.19.0, < 0.24.0, and the patched version is 0.24.0. The advisory does not state a workaround beyond noting that --allowed-media-domains, fetch timeouts, and HTTP body limits do not enforce a decoded duration budget. Detection guidance is not stated, and no CVE ID is assigned in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/vllm-project/vllm/security/advisories/GHSA-r45p-7qwx-qwjw Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.2	CVE-2026-116174	vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs... vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 25 14:16 UTC
CVE-2026-116174vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs... Executive summary The advisory says vLLM versions from 0.22.0 before 0.24.0 contain an input validation flaw in the Rust gRPC Generate and GenerateStream service that lets a single request with an invalid prompt token ID crash the inference engine and leave the server unhealthy. The advisory rates it Moderate, and the vendor's recommended fix is to upgrade to vLLM 0.24.0, which is listed as the patched version. Technical summary This is improper input validation (CWE-20) with an uncontrolled resource consumption angle (CWE-400). The gRPC Generate and GenerateStream handlers forward pre-tokenized prompt token IDs to the engine without checking them against tokenizer or model vocabulary bounds, so an out-of-vocabulary value such as 9000000 can trigger a fatal EngineCore failure and make the server unhealthy. The attack vector is network access to the Rust gRPC endpoint with no privileges or user interaction stated as required in the vector used by the publisher; the advisory notes the vector would be PR:L if clients must be authorized. Affected versions are >= 0.22.0, < 0.24.0, with patched version 0.24.0. The advisory's suggested CVSS 3.1 scores are 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and 6.5 with PR:L, while the NVD overall score shown is 5.9 with AC:H. Workarounds are not stated. Exploitation in the wild is not stated. Detection guidance is not stated beyond the suggested fix of returning INVALID_ARGUMENT for out-of-range token IDs. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/vllm-project/vllm/security/advisories/GHSA-w2v2-5662-8v5q Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.2	CVE-2026-116173	vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust... vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 25 14:16 UTC
CVE-2026-116173vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust... Executive summary Versions of vLLM from 0.22.0 before 0.24.0 contain a denial-of-service flaw that lets a remote attacker crash the engine core with a single crafted request. The advisory rates it Moderate, with a CVSS 5.9 score, and the fix is to upgrade to vLLM 0.24.0. Technical summary The flaw is missing input validation (CWE-20) in the Rust gRPC Generate and GenerateStream path, which accepts output_candidates.token_ids and passes them into SamplingParams.logprob_token_ids without the length cap of 128, vocabulary range checks, or logprobs consistency checks that the Python API enforces. A request with output_logprobs set to true and more than 128 candidate token IDs is accepted, reaches the V1 GPU logprob sampler, and raises a ValueError there, which EngineCore treats as a fatal error. The advisory lists the attack vector as network, attack complexity as high, no privileges or user interaction required, and availability as the only impact, with a base score of 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Affected versions are stated as 0.22.0 up to but not including 0.24.0, and the patched version is 0.24.0. The advisory does not state any workaround, any detection guidance, or whether the flaw has been exploited in the wild. Its suggested fix is to reject oversized or out-of-vocabulary candidate ID lists with INVALID_ARGUMENT before any engine request is submitted. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/vllm-project/vllm/security/advisories/GHSA-6pgw-f3pv-4h8q Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.2	CVE-2026-116172	vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass max_logprobs limits via... vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 25 14:16 UTC
CVE-2026-116172vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass max_logprobs limits via... Executive summary A flaw in the Rust gRPC interface of vLLM versions from 0.22.0 before 0.24.0 lets a remote caller bypass the configured limit on logprob counts, which can crash the inference engine. The advisory rates it Moderate with a CVSS 3.1 base score of 5.9, and the fix is to upgrade to vLLM 0.24.0. Technical summary The vulnerability is improper input validation (CWE-20) with an unsigned-to-signed integer cast (CWE-190) in the Rust gRPC converter, which copies the CandidateTokens.top_n value into SamplingParams.logprobs or prompt_logprobs without checking the max_logprobs cap. Values such as 1000000 or 2147483648 (which wraps to a negative number) reach the V1 sampler's torch.topk path and can raise an error that the advisory says makes EngineCore fail. The attack requires network access to the Rust gRPC endpoint with no privileges or user interaction, and the advisory's impact is availability only (CVSS AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H in the NVD metrics). The fixed version is stated as 0.24.0, and the advisory says the patch is to validate top_n against max_logprobs and i32 range. No workaround is stated, and no detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/vllm-project/vllm/security/advisories/GHSA-rwfw-xvg3-3937 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.7	CVE-2026-114055	vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying... vllm-projectvllm-project vllm	NVD	Oct 21 01:17 UTC
CVE-2026-114055vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying... From the advisory vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mm_processor_kwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac, InternVL, H2OVL, and other processors to exhaust memory and terminate the shared server. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project vllm-project vllm NIST National Vulnerability DatabasePublished Oct 21, 2026 01:17 UTC Read the advisory
	High	7.1	CVE-2026-114054	vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF... vllm-projectvllm-project vllm	NVD	Oct 21 01:17 UTC
CVE-2026-114054vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF... From the advisory vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF ImageID or cache_salt. Attackers can set a UUID EXIF ImageID to receive another request's cached processed media, or match cache_salt to a LoRA name to reuse first-block KV state. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project vllm-project vllm NIST National Vulnerability DatabasePublished Oct 21, 2026 01:17 UTC Read the advisory
	Critical	9.2	CVE-2026-114053	vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which... vllm-projectvllm-project vllm	NVD	Oct 21 01:17 UTC
CVE-2026-114053vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which... From the advisory vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint to execute arbitrary Python in the vLLM API process. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project vllm-project vllm NIST National Vulnerability DatabasePublished Oct 21, 2026 01:17 UTC Read the advisory
	High	8.7	CVE-2026-114052	vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled... vllm-projectvllm-project vllm	NVD	Oct 21 01:17 UTC
CVE-2026-114052vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled... From the advisory vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm_processor_kwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized mel_config values to the /tokenize endpoint, which bypasses --api-key, to exhaust host memory and crash the API process. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project vllm-project vllm NIST National Vulnerability DatabasePublished Oct 21, 2026 01:17 UTC Read the advisory
	High	7.1	CVE-2026-114051	vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught... vllm-projectvllm-project vllm	NVD	Oct 21 01:17 UTC
CVE-2026-114051vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught... From the advisory vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized min_tokens to hang all subsequent generation requests until manual restart. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project vllm-project vllm NIST National Vulnerability DatabasePublished Oct 21, 2026 01:17 UTC Read the advisory
	High	7.1	CVE-2026-114050	vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes vllm-projectvllm-project vllm	NVD	Oct 21 01:17 UTC
CVE-2026-114050vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes From the advisory vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving instance until restarted. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project vllm-project vllm NIST National Vulnerability DatabasePublished Oct 21, 2026 01:17 UTC Read the advisory
	Medium	6.3	CVE-2026-114049	vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain other clients' outputs by leaving stale... vllm-projectvllm-project vllm	NVD	Oct 21 01:17 UTC
CVE-2026-114049vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain other clients' outputs by leaving stale... From the advisory vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain other clients' outputs by leaving stale allowed_token_ids rows. Attackers can submit concurrent constrained generate requests, including via unauthenticated /invocations, so recycled batch slots apply their token allowlist to victims' unrestricted requests. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project vllm-project vllm NIST National Vulnerability DatabasePublished Oct 21, 2026 01:17 UTC Read the advisory
	High	7.1	CVE-2026-109311	vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow vllm-projectvllm-project vllm	NVD	Oct 12 17:17 UTC
CVE-2026-109311vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow From the advisory vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow. Authenticated remote attackers can repeatedly upload malformed IAMF containers to /v1/audio/transcriptions, corrupting the heap and crashing the API process. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project vllm-project vllm NIST National Vulnerability DatabasePublished Oct 12, 2026 17:17 UTC Read the advisory
	Low	2.1	CVE-2026-105922	A security flaw has been discovered in vllm-project vLLM up to 0.31.0 vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 6 15:17 UTC
CVE-2026-105922A security flaw has been discovered in vllm-project vLLM up to 0.31.0 From the advisory A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty Handler. Performing a manipulation results in denial of service. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 6, 2026 15:17 UTC Read the advisory
	Low	2.1	CVE-2026-105775	A security vulnerability has been detected in vllm-project vLLM up to 0.31.0 vllm-projectvllm-project vllm	NVD	Oct 6 06:17 UTC
CVE-2026-105775A security vulnerability has been detected in vllm-project vLLM up to 0.31.0 From the advisory A security vulnerability has been detected in vllm-project vLLM up to 0.31.0. This impacts the function conv_ssm_forward of the file vllm/model_executor/layers/mamba/mamba_mixer2.py of the component Completions Request Handler. The manipulation leads to out-of-bounds read. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project vllm-project vllm NIST National Vulnerability DatabasePublished Oct 6, 2026 06:17 UTC Read the advisory
	Medium	5.3	CVE-2026-105760	vLLM is an inference and serving engine for large language models vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 5 23:17 UTC
CVE-2026-105760vLLM is an inference and serving engine for large language models From the advisory vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level media_io_kwargs field to select the GLMGA video backend and supply large values for the fps and max_frames options without a strict work ceiling. GLMGA constructs and deduplicates an attacker-sized pre-decode frame-index list, allowing a compact request and tiny valid video to consume disproportionate CPU time and memory in the shared media-loading executor. This issue is fixed in version 0.30.0. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 5, 2026 23:17 UTC Read the advisory
	High	7.5	CVE-2026-105759	vLLM is an inference and serving engine for large language models vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 5 23:17 UTC
CVE-2026-105759vLLM is an inference and serving engine for large language models From the advisory vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker can send unique arbitrary method tokens to unguarded routes such as /tokenize, causing Prometheus's Family::get_or_create function to permanently create counter and histogram label sets. Those label sets increase process memory usage and enlarge the /metrics response until the service or monitoring path is exhausted. This issue is fixed in version 0.30.0. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 5, 2026 23:17 UTC Read the advisory
	Medium	5.3	CVE-2026-105758	vLLM is an inference and serving engine for large language models vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 5 23:17 UTC
CVE-2026-105758vLLM is an inference and serving engine for large language models From the advisory vLLM is an inference and serving engine for large language models. From 0.24.0 until 0.30.0, the Qwen2VLVideoBackend and Qwen3VLVideoBackend classes accept request-level values for the media_io_kwargs.video.max_frames and media_io_kwargs.video.fps fields without enforcing server-side ceilings. An unauthenticated caller can submit these values to the /tokenize endpoint, causing the sampler to decode every frame selected from attacker-controlled video input, consume disproportionate frontend memory, and potentially terminate the API process before scheduling or admission control. The Rust frontend is not affected because it rejects the media_io_kwargs field. This issue is fixed in version 0.30.0. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 5, 2026 23:17 UTC Read the advisory
	Medium	6.5	CVE-2026-105757	vLLM is an inference and serving engine for large language models vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 5 23:17 UTC
CVE-2026-105757vLLM is an inference and serving engine for large language models From the advisory vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path. A per-request backend mismatch can re-raise a grammar compilation exception, padding produced by the ngram_gpu speculative-decoding mode can pass a negative token to guidance validation, and the Rust frontend can admit empty structured-output values that the Python frontend rejects, allowing ordinary constrained-generation requests to terminate the shared engine. This issue is fixed in version 0.30.0. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 5, 2026 23:17 UTC Read the advisory
	Medium	6.5	CVE-2026-105756	vLLM is an inference and serving engine for large language models vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 5 23:17 UTC
CVE-2026-105756vLLM is an inference and serving engine for large language models From the advisory vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing the character and length restrictions required by the IPCCacheServerKey consumer in LMCache-MP. On deployments using the LMCache-MP connector, a salt that contains a forbidden character or exceeds the permitted length can raise an uncaught ValueError during scheduler cache lookup, causing EngineCore to terminate and denying service to all concurrent users. This issue is fixed in version 0.30.0. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 5, 2026 23:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory