CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 10:23 UTC)

What this means for you

This week: 5,476 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,476; Show in the list
Critical, last 7 days: 358; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product vllm:vllm. Show all products

75 CVEs, showing 51 to 75PreviousPage 2 of 2

CVE	Severity	Title	Published
CVE-2026-54232	High 8.8	vLLM is an inference and serving engine for large language models (LLMs).	Jun 22, 2026
CVE-2026-53923	High 7.5	vLLM is an inference and serving engine for large language models (LLMs).	Jun 22, 2026
CVE-2026-48746	Critical 9.1	vLLM is an inference and serving engine for large language models (LLMs).	Jun 22, 2026
CVE-2026-47155	Medium 6.5	vLLM is an inference and serving engine for large language models (LLMs).	Jun 22, 2026
CVE-2026-41523	High 7.5	vLLM is an inference and serving engine for large language models (LLMs).	Jun 22, 2026
CVE-2026-56340	High 7.5	vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing.	Jun 20, 2026
CVE-2025-71379	High 7.5	vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities.	Jun 20, 2026
CVE-2026-5497	High 7.5	vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method.	Jun 11, 2026
CVE-2026-44223	Medium 6.5	vLLM is an inference and serving engine for large language models (LLMs).	May 12, 2026
CVE-2026-44222	High 7.5	vLLM is an inference and serving engine for large language models (LLMs).	May 12, 2026
CVE-2026-7141	Medium 5.6	A vulnerability was found in vLLM up to 0.19.0.	Apr 27, 2026
CVE-2026-34756	Medium 6.5	vLLM is an inference and serving engine for large language models (LLMs).	Apr 6, 2026
CVE-2026-34755	Medium 6.5	vLLM is an inference and serving engine for large language models (LLMs).	Apr 6, 2026
CVE-2026-34753	Medium 5.4	vLLM is an inference and serving engine for large language models (LLMs).	Apr 6, 2026
CVE-2026-34760	High 7.1	vLLM is an inference and serving engine for large language models (LLMs).	Apr 2, 2026
CVE-2026-27893	High 8.8	vLLM is an inference and serving engine for large language models (LLMs).	Mar 27, 2026
CVE-2026-25960	Critical 9.8	vLLM is an inference and serving engine for large language models (LLMs).	Mar 9, 2026
CVE-2026-22778	Critical 9.8	vLLM is an inference and serving engine for large language models (LLMs).	Feb 2, 2026
CVE-2026-24779	High 7.1	vLLM is an inference and serving engine for large language models (LLMs).	Jan 27, 2026
CVE-2026-22807	Critical 9.8	vLLM is an inference and serving engine for large language models (LLMs).	Jan 21, 2026
CVE-2026-22773	High 7.5	vLLM is an inference and serving engine for large language models (LLMs).	Jan 10, 2026
CVE-2025-66448	High 8.8	vLLM is an inference and serving engine for large language models (LLMs).	Dec 1, 2025
CVE-2025-62426	Medium 6.5	vLLM is an inference and serving engine for large language models (LLMs).	Nov 21, 2025
CVE-2025-62372	Medium 6.5	vLLM is an inference and serving engine for large language models (LLMs).	Nov 21, 2025
CVE-2025-62164	High 8.8	vLLM is an inference and serving engine for large language models (LLMs).	Nov 21, 2025

PreviousPage 2 of 2

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.