CVE Tools
Track your stack

Vllm

19 CVEs tracked since 2025. Since May 2025, none of them reached CISA KEV.

Vllm CVEs per month

May 2025 to Jun 2026. Point at a month, or focus the strip and use the arrow keys.
Vllm CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2025-0580
2025-06null or fewer
2025-07null or fewer
2025-08null or fewer
2025-09null or fewer
2025-10null or fewer
2025-11null or fewer
2025-12null or fewer
2026-01null or fewer
2026-02null or fewer
2026-03null or fewer
2026-04null or fewer
2026-05null or fewer
2026-06110

Products

The products that kept showing up in Vllm's monthly top three, with their CVEs summed over those months.

  1. Vllm192 months

Latest CVEs

The 15 most recently published vulnerabilities affecting Vllm.

  1. CVE-2026-90555vLLM before 0.28.0 Denial of Service via Audio Header6.5
  2. CVE-2026-90554vLLM before 0.28.0 Denial of Service via audio extraction6.2
  3. CVE-2026-90553vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor7.8
  4. CVE-2026-55514vLLM denial of service via prompt embeds on M-RoPE models6.5
  5. CVE-2026-55574vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends7.5
  6. CVE-2026-54234vLLM: Remote DoS in vLLM via Invalid Recovered Token Reinjection7.5
  7. CVE-2026-55646vLLM speech-to-text endpoints allocate full upload before enforcing the audio file-size limit6.5
  8. CVE-2026-47155vLLM: Artifact Pin Decay in vLLM allows pinned deployments to load unpinned code, weights, and processors6.5
  9. CVE-2026-41523vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution7.5
  10. CVE-2026-54232vLLM: Dependency Confusion Vulnerability in vLLM Dockerfile8.8
  11. CVE-2026-54233vLLM: OOM Denial of Service via Audio Decompression Bomb6.5
  12. CVE-2026-54236vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router5.3
  13. CVE-2026-54235vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels6.5
  14. CVE-2026-48746vLLM: OpenAI auth bypass9.1
  15. CVE-2026-53923vLLM GGUF Kernels: int64_t to int truncation of tensor dimensions causes GPU buffer overflow7.5

The record

Peak rank
#103 in May 2025
Busiest month shown
Jun 2026, 11 CVEs
Months with a KEV entry
0 since May 2025
Monthly snapshots
2 since 2025
Vllm's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store