Known Vulnerabilities for products from Vllm
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Vllm".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-109311 json | Not Provided | 2026-10-12 | 2026-10-12 | |
| CVE-2026-105922 json | A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mas... | Not Provided | 2026-10-06 | 2026-10-09 |
| CVE-2026-105775 json | Not Provided | 2026-10-06 | 2026-10-09 | |
| CVE-2026-105760 json | Not Provided | 2026-10-05 | 2026-10-06 | |
| CVE-2026-105759 json | Not Provided | 2026-10-05 | 2026-10-06 | |
| CVE-2026-105758 json | vLLM is an inference and serving engine for large language models. From 0.24.0 until 0.30.0, the Qwen2VLVideoBackend and Qwen... | Not Provided | 2026-10-05 | 2026-10-08 |
| CVE-2026-105757 json | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can es... | Not Provided | 2026-10-05 | 2026-10-08 |
| CVE-2026-105756 json | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a... | Not Provided | 2026-10-05 | 2026-10-08 |
| CVE-2026-105755 json | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /sc... | Not Provided | 2026-10-05 | 2026-10-08 |
| CVE-2026-105754 json | Not Provided | 2026-10-05 | 2026-10-08 | |
| CVE-2026-105753 json | vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache... | Not Provided | 2026-10-05 | 2026-10-08 |
| CVE-2026-105752 json | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted thro... | Not Provided | 2026-10-05 | 2026-10-08 |
| CVE-2026-103241 json | A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/... | Not Provided | 2026-09-30 | 2026-10-06 |
| CVE-2026-100654 json | vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/com... | Not Provided | 2026-09-26 | 2026-10-07 |
| CVE-2026-100652 json | vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends... | Not Provided | 2026-09-26 | 2026-10-06 |
| CVE-2026-100651 json | vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/gene... | Not Provided | 2026-09-26 | 2026-10-06 |
| CVE-2026-100650 json | vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the... | Not Provided | 2026-09-26 | 2026-10-06 |
| CVE-2026-100649 json | vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass... | Not Provided | 2026-09-26 | 2026-10-06 |
| CVE-2026-100648 json | vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, allowing unauthe... | Not Provided | 2026-09-26 | 2026-10-06 |
| CVE-2026-100647 json | vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter accepted on OpenAI-compatib... | Not Provided | 2026-09-26 | 2026-10-06 |