CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 10:23 UTC)

What this means for you

This week: 5,468 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,468; Show in the list
Critical, last 7 days: 357; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product ggml:llama.cpp. Show all products

17 CVEs, showing 1 to 17

CVE	Severity	Title	Published
CVE-2026-21869	Critical 9.8	llama.cpp is an inference of several LLM models in C/C++.	Jan 8, 2026
CVE-2026-27940	High 7.8	llama.cpp is an inference of several LLM models in C/C++.	Mar 12, 2026
CVE-2026-33298	High 7.8	llama.cpp is an inference of several LLM models in C/C++.	Mar 24, 2026
CVE-2026-34159	Critical 9.8	llama.cpp is an inference of several LLM models in C/C++.	Apr 1, 2026
CVE-2026-43622	High 7.8	llama.cpp b1886–b7445 Double Free via llama-android.cpp Assigned by VulnCheck	Aug 6, 2026
CVE-2026-70638	High 7.8	llama.cpp b1886–b7445 Integer Overflow via new_1batch() in llama-android.cpp Assigned by VulnCheck	Aug 6, 2026
CVE-2026-70639	Medium 5.5	llama.cpp b1886–b7445 Null Pointer Dereference DoS via llama-android.cpp Assigned by VulnCheck	Aug 6, 2026
CVE-2026-70640	High 7.0	llama.cpp b1886–b7445 Race Condition Use-After-Free via llama-android.cpp Assigned by VulnCheck	Aug 6, 2026
CVE-2026-43627	High 7.8	llama.cpp b1283–b9058 Integer Overflow in llama_batch_init() Function Assigned by VulnCheck	Aug 6, 2026
CVE-2026-43628	High 7.8	llama.cpp b3978–b9058 Integer Underflow via DRY Sampler Assigned by VulnCheck	Aug 6, 2026
CVE-2026-43629	High 8.1	llama.cpp b4882–b9058 Buffer Overflow in KV Cache State Restore Assigned by VulnCheck	Aug 6, 2026
CVE-2026-43630	Medium 6.5	llama.cpp b5702–b7653 Out-of-Bounds Read Information Disclosure Assigned by VulnCheck	Aug 6, 2026
CVE-2026-43631	High 8.1	llama.cpp b7492–b9060 Use-After-Free RCE via llama-server Assigned by VulnCheck	Aug 6, 2026
CVE-2026-43632	High 8.1	llama.cpp b7492–b9060 Use-After-Free in Tokenization Endpoints Assigned by VulnCheck	Aug 6, 2026
CVE-2026-52132	High 7.5	llama.cpp through commit 97f06e9, when started with the --reranking flag, allows remote attackers to cause a denial of service (std::bad_alloc and HTTP 500) via a negative top_n value in a POST reque… Assigned by mitre	Sep 1, 2026
CVE-2026-52131	High 7.5	llama.cpp b5693 and before has a Reachable Assertion via the gguf_reader::read function. Assigned by mitre	Sep 1, 2026
CVE-2026-52130	High 7.5	llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service. Assigned by mitre	Sep 1, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.