8
CVEs
0
Critical
2
High
0
KEV
2
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
2
MEDIUM
4
LOW
2
Monthly CVE Trend
Affected Products (4)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-90553 | Remote code execution in vLLM's LlavaOnevision2 processor loader allows an attacker who controls a model repository to execute arbitrary code on systems that load that model, bypassing the trust_remote_code=False safety parameter entirely. All vLLM installations prior to version 0.28.0 are affected when loading LlavaOnevision2-architecture models; the security control that operators rely on to safely evaluate third-party models is silently non-functional for this processor class. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the attack requires only the ability to publish a model to an accessible registry and social-engineer a user into loading it. | HIGH | 8.5 | 0.2% | 43 |
|
| CVE-2026-90555 | Uncontrolled memory allocation in vLLM's transcription endpoint before 0.28.0 allows authenticated API clients to crash the entire server process by submitting FLAC audio files with forged, inflated sample rate headers. Because vLLM commonly operates as a shared API server across multiple tenants, a single authenticated attacker can deny service to all concurrent users. VulnCheck reported this with a CVSS 4.0 score of 7.1; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 7.1 | 0.3% | 36 |
|
| CVE-2026-78684 | Remote denial-of-service in vLLM before 0.27.0 allows unauthenticated network attackers to activate the DeepStream GPU video-decode backend per-request, initialize the process-wide GPU decode pool, and submit video content that bypasses pixel-limit enforcement, causing partial availability loss for concurrent inference requests. The root cause is vLLM's failure to classify DeepStream as a GPU backend subject to resource controls combined with an omitted pixel-limit check in the DeepStream decode path (CWE-400). No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog. | MEDIUM | 6.9 | 0.3% | 35 |
|
| CVE-2026-90554 | Unbounded audio extraction in vLLM 0.10.2-0.27.x enables remote denial of service against NanoNemotronVL model deployments. The root cause is an asymmetric protection gap: `_extract_audio_from_videos` in `nano_nemotron_vl.py` calls `load_audio_pyav` without the size or duration guard parameters enforced on the direct audio upload path, bypassing the `VLLM_MAX_AUDIO_DECODE_DURATION_S` and `VLLM_MAX_AUDIO_DECODE_BYTES` environment variable limits entirely. An attacker submitting a maliciously compressed video via the multimodal inference API forces the server to allocate gigabytes of memory during audio decoding, crashing the service. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patch is available in vLLM 0.28.0. | MEDIUM | 6.9 | 0.1% | 35 |
|
| CVE-2026-92220 | Unbounded buffering of unacknowledged KV-transfer acknowledgements in the MoRIIO connector of vLLM 0.26.0 and 0.27.0 allows a remote, unauthenticated client to grow worker memory indefinitely and degrade or crash LLM inference serving. The root cause is CWE-400 uncontrolled resource consumption in moriio_connector.py, where acknowledgements whose transfer mapping is not yet populated are appended to _pending_unmapped_acks with no TTL or size cap across request_finished, get_finished and _handle_release_message. Impact is availability-only (CVSS 4.0 base 6.9, AV:N/AC:L/PR:N/UI:N/VA:L); no public exploit code and no CISA KEV | MEDIUM | 6.9 | – | 34 |
|
| CVE-2026-73560 | Server-side request forgery in vLLM's MiMoV2OmniMultiModalProcessor allows authenticated API users to bypass the framework's media access controls, enabling arbitrary file reads on the vLLM host and SSRF requests to internal network resources. The flaw affects all vLLM releases prior to 0.26.0 where attacker-controlled image and audio URL strings were passed directly to _fetch_image, requests.get, and Image.open instead of routing through the MediaConnector abstraction that enforces allowed_media_domains and allowed_local_media_path restrictions. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and network-accessible vector make this a meaningful risk for deployments serving untrusted authenticated users via the affected multimodal processor. | MEDIUM | 6.5 | 0.3% | 33 |
|
| CVE-2026-90878 | A resource-exhaustion (denial of service) flaw in vLLM's OpenAI-compatible /v1/chat/completions endpoint lets a caller- or model-supplied Jinja chat_template drive nested range() loops whose evaluation cost grows as O(N^depth), tying up a request-runtime worker thread for tens of seconds. vLLM releases up to and including 0.27.1 are affected (EUVD lists 0.27.0 and 0.27.1), with the CPE range expressed as vllm-project:vllm:* so earlier releases are plausibly in scope too. Publicly available exploit code exists, and CVSS 4.0 rates the issue only 2.1 with availability impact rated Low; a fix PR that introduces a minijinja evaluation 'fuel' budget is still awaiting acceptance. | LOW | 2.1 | 0.3% | 31 |
PoC
|
| CVE-2026-90713 | Denial-of-service in vLLM's Rust-based tiktoken tokenizer allows a local low-privileged attacker to crash the vLLM process by supplying a crafted vocab file containing duplicate token ranks. The TiktokenTokenizer::new() function in the Rust tokenizer backend previously panicked unconditionally when parsing a tiktoken file with two tokens sharing the same rank value, rather than returning a graceful error. A public proof-of-concept exploit is available via GitHub Gist; no patch has been merged as the fixing pull request remains open. | LOW | 1.9 | 0.2% | 30 |
PoC
|