Medium
CVE-2026-47155
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 100
Reset filters
High
CVE-2026-41523
vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution
High
CVE-2026-54232
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the flashinfer-jit-cache package.
Critical
CVE-2026-48746
vLLM: OpenAI auth bypass
High
CVE-2026-56340
vLLM introduced enhanced protection for CVE-2025-62164
High
CVE-2026-5497
vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method. When processin
Medium
CVE-2026-44223
vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters
Low
CVE-2026-7141
vLLM makes Use of Uninitialized Resource
Medium
CVE-2026-34756
vLLM: Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server
Medium
CVE-2026-34755
vLLM: Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing
Medium
CVE-2026-34760
vLLM: Processing differential in multi-channel audio downmixing enables hidden-input/moderation bypass for audio models
High
CVE-2026-27893
vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out
Medium
CVE-2026-22773
vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions
Medium
CVE-2025-48943
vLLM allows clients to crash the openai server with invalid regex
Medium
CVE-2025-48942
vLLM DOS: Remotely kill vllm over http with invalid JSON schema
Medium
CVE-2025-48887
vLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py`
Low
CVE-2025-46570
Potential Timing Side-Channel Vulnerability in vLLM’s Chunk-Based Prefix Caching
Medium
CVE-2025-46722
vLLM has a Weakness in MultiModalHasher Image Hashing Implementation
Medium
CVE-2025-71379
vLLM vulnerable to Regular Expression Denial of Service
Critical
CVE-2025-32444
vLLM Vulnerable to Remote Code Execution via Mooncake Integration
Critical
ghsa-ggpf-24jw-3fcw
CVE-2025-24357 Malicious model remote code execution fix bypass with PyTorch < 2.6.0
Medium
ghsa-hf3c-wxg2-49q9
vLLM vulnerable to Denial of Service by abusing xgrammar cache
Medium
CVE-2025-32381
xgrammar Vulnerable to Denial of Service (DoS) by abusing unbounded cache in memory
Critical
CVE-2024-9053
vLLM allows Remote Code Execution by Pickle Deserialization via AsyncEngineRPCServer() RPC server entrypoints
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.