CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 10:23 UTC)

What this means for you

This week: 5,468 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,468; Show in the list
Critical, last 7 days: 357; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product vllm:vllm. Show all products

75 CVEs, showing 1 to 50Page 1 of 2Next

CVE	Severity	Title	Published
CVE-2025-62164	High 8.8	vLLM is an inference and serving engine for large language models (LLMs).	Nov 21, 2025
CVE-2025-62372	Medium 6.5	vLLM is an inference and serving engine for large language models (LLMs).	Nov 21, 2025
CVE-2025-62426	Medium 6.5	vLLM is an inference and serving engine for large language models (LLMs).	Nov 21, 2025
CVE-2025-66448	High 8.8	vLLM is an inference and serving engine for large language models (LLMs).	Dec 1, 2025
CVE-2026-22773	High 7.5	vLLM is an inference and serving engine for large language models (LLMs).	Jan 10, 2026
CVE-2026-22807	Critical 9.8	vLLM is an inference and serving engine for large language models (LLMs).	Jan 21, 2026
CVE-2026-24779	High 7.1	vLLM is an inference and serving engine for large language models (LLMs).	Jan 27, 2026
CVE-2026-22778	Critical 9.8	vLLM is an inference and serving engine for large language models (LLMs).	Feb 2, 2026
CVE-2026-25960	Critical 9.8	vLLM is an inference and serving engine for large language models (LLMs).	Mar 9, 2026
CVE-2026-27893	High 8.8	vLLM is an inference and serving engine for large language models (LLMs).	Mar 27, 2026
CVE-2026-34760	High 7.1	vLLM is an inference and serving engine for large language models (LLMs).	Apr 2, 2026
CVE-2026-34753	Medium 5.4	vLLM is an inference and serving engine for large language models (LLMs).	Apr 6, 2026
CVE-2026-34755	Medium 6.5	vLLM is an inference and serving engine for large language models (LLMs).	Apr 6, 2026
CVE-2026-34756	Medium 6.5	vLLM is an inference and serving engine for large language models (LLMs).	Apr 6, 2026
CVE-2026-7141	Medium 5.6	A vulnerability was found in vLLM up to 0.19.0.	Apr 27, 2026
CVE-2026-44222	High 7.5	vLLM is an inference and serving engine for large language models (LLMs).	May 12, 2026
CVE-2026-44223	Medium 6.5	vLLM is an inference and serving engine for large language models (LLMs).	May 12, 2026
CVE-2026-5497	High 7.5	vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method.	Jun 11, 2026
CVE-2025-71379	High 7.5	vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities.	Jun 20, 2026
CVE-2026-56340	High 7.5	vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing.	Jun 20, 2026
CVE-2026-41523	High 7.5	vLLM is an inference and serving engine for large language models (LLMs).	Jun 22, 2026
CVE-2026-47155	Medium 6.5	vLLM is an inference and serving engine for large language models (LLMs).	Jun 22, 2026
CVE-2026-48746	Critical 9.1	vLLM is an inference and serving engine for large language models (LLMs).	Jun 22, 2026
CVE-2026-53923	High 7.5	vLLM is an inference and serving engine for large language models (LLMs).	Jun 22, 2026
CVE-2026-54232	High 8.8	vLLM is an inference and serving engine for large language models (LLMs).	Jun 22, 2026
CVE-2026-54233	Medium 6.5	vLLM is an inference and serving engine for large language models (LLMs).	Jun 22, 2026
CVE-2026-54235	Medium 6.5	vLLM is an inference and serving engine for large language models (LLMs).	Jun 22, 2026
CVE-2026-54236	Medium 5.3	vLLM is an inference and serving engine for large language models (LLMs).	Jun 22, 2026
CVE-2026-55646	Medium 6.5	vLLM is an inference and serving engine for large language models.	Jul 6, 2026
CVE-2026-54234	High 7.5	vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs.	Jul 6, 2026
CVE-2026-55514	Medium 6.5	vLLM is a library for LLM inference and serving.	Jul 6, 2026
CVE-2026-55574	High 7.5	vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs.	Jul 6, 2026
CVE-2026-73555	Medium 5.3	vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages Assigned by GitHub_M	Aug 13, 2026
CVE-2026-73556	Medium 5.3	vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574 Assigned by GitHub_M	Aug 13, 2026
CVE-2026-73557	Medium 6.3	vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts Assigned by GitHub_M	Aug 13, 2026
CVE-2026-73558	Medium 5.3	vLLM: Cross-User Data Leak Vulnerability Assigned by GitHub_M	Aug 13, 2026
CVE-2026-73559	Medium 6.5	vLLM: Completion prompt lists fan out into unbounded engine requests Assigned by GitHub_M	Aug 13, 2026
CVE-2026-71486	Medium 4.3	vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds Assigned by GitHub_M	Aug 17, 2026
CVE-2026-73560	Medium 6.5	vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections Assigned by GitHub_M	Aug 17, 2026
CVE-2026-78684	Medium 5.3	vLLM before 0.27.0 Denial of Service via DeepStream Backend Assigned by VulnCheck	Aug 25, 2026
CVE-2026-37237	High 7.5	vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. Assigned by mitre	Aug 28, 2026
CVE-2026-90553	High 7.8	vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor Assigned by VulnCheck	Sep 12, 2026
CVE-2026-90554	Medium 6.2	vLLM before 0.28.0 Denial of Service via audio extraction Assigned by VulnCheck	Sep 12, 2026
CVE-2026-90555	Medium 6.5	vLLM before 0.28.0 Denial of Service via Audio Header Assigned by VulnCheck	Sep 12, 2026
CVE-2026-57173	Medium 6.5	vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions Assigned by GitHub_M	Sep 16, 2026
CVE-2026-69147	Medium 6.5	vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation Assigned by GitHub_M	Sep 16, 2026
CVE-2026-93436	High 7.5	vLLM through 0.29.0 Memory Exhaustion via Rejected Requests Assigned by VulnCheck	Sep 17, 2026
CVE-2026-93592	High 7.5	vLLM before 0.28.0 Denial of Service via negative token ID Assigned by VulnCheck	Sep 18, 2026
CVE-2026-93840	Low 3.7	vLLM before 0.29.0 Cross-Request Logits Corruption via allowed_token_ids Assigned by VulnCheck	Sep 18, 2026
CVE-2026-93841	Low 3.7	vLLM through 0.29.0 Adjacent-Request Sampler State Corruption via Unvalidated Prompt Token IDs Assigned by VulnCheck	Sep 18, 2026

Page 1 of 2Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.