Unrated
CVE-2026-93436
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 100
Reset filters
Unrated
CVE-2026-90553
vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes. Attackers
Medium
CVE-2026-71486
vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds
Medium
CVE-2026-73558
vLLM: Cross-User Data Leak Vulnerability
Medium
CVE-2026-73560
vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections
Medium
CVE-2026-73555
vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages
Medium
CVE-2026-73556
vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m
Medium
CVE-2026-73557
vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts
Unrated
CVE-2026-78684
vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to ini
Medium
CVE-2026-73559
vLLM: Completion prompt lists fan out into unbounded engine requests
High
CVE-2026-91987
atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard
High
CVE-2026-54234
vLLM has Remote DoS via Invalid Recovered Token Reinjection
Low
CVE-2026-10813
LMCache: 16-bit multimodal hash collision can poison KV cache entries
Medium
CVE-2026-12491
vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations
Medium
CVE-2026-54233
vLLM: OOM Denial of Service via Audio Decompression Bomb
Medium
CVE-2026-54235
vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels
Medium
CVE-2026-53923
vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving
Medium
CVE-2026-54236
vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router
Medium
CVE-2026-9540
vllm has Improper Resource Shutdown or Release
High
CVE-2026-46517
lmdeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out
Medium
CVE-2026-44222
vLLM Vulnerable to Remote DoS via Special-Token Placeholders
Medium
CVE-2026-34753
vLLM: Server-Side Request Forgery (SSRF) in `download_bytes_from_url `
Medium
CVE-2026-25960
vLLM has SSRF Protection Bypass
High
CVE-2026-24779
vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.