vLLM kayıtları
vLLM üreticisine ait 119 yayımlanmış kayıt. Bunların 0 tanesi sahada sömürüldü (CISA KEV listesinde), 1 tanesi için hazır saldırı aracı var.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 1 · %0,8
- Pre-auth RCE
- 12
- Düzeltme kaydı olan
- %97,5
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Pre-auth RCE: saldırganın hesabı olmadan, ağ üzerinden kod çalıştırabildiği açıklar. Yayından KEV’e ortanca: sahada sömürülen kayıtların yayımlanmasıyla CISA listesine girmesi arasındaki tipik süre.
Tekrar eden sınıflar
- CWE-400 Uncontrolled Resource Consumption19
- CWE-20 Improper Input Validation15
- CWE-770 Allocation of Resources Without Limits or Throttling13
- CWE-129 Improper Validation of Array Index9
- CWE-502 Deserialization of Untrusted Data7
- CWE-918 Server-Side Request Forgery (SSRF)5
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWETüm kayıtlar
119 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | EPSS · Yayın |
|---|---|---|---|---|
60Bu hafta | CVE-2026-22778Silahlaştırılmış | vLLM leaks a heap address when PIL throws an errorvllm · vllm · CWE-532 | Kritik9,8 | %18,22 Şub 2026 |
40Planlayın | CVE-2025-32444İstismar yok | vLLM Vulnerable to Remote Code Execution via Mooncake Integrationvllm · vllm · CWE-502 | Kritik9,8 | %1,829 Nis 2025 |
40Planlayın | CVE-2024-11041İstismar yok | Remote Code Execution in vllm-project/vllmvllm · vllm · CWE-502 | Kritik9,8 | %1,720 Mar 2025 |
39İzleyin | CVE-2026-22807Kavram kanıtı | vLLM affected by RCE via auto_map dynamic module loading during model initializationvllm · vllm · CWE-94 | Kritik9,8 | %0,921 Oca 2026 |
39İzleyin | CVE-2025-47277İstismar yok | vLLM Allows Remote Code Execution via PyNcclPipe Communication Servicevllm · vllm · CWE-502 | Kritik9,8 | %0,920 May 2025 |
39İzleyin | CVE-2026-115915İstismar yok | vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCEvllm · vllm · CWE-20 | Kritik9,8 | %0,626 Eki 2026 |
39İzleyin | CVE-2026-25960İstismar yok | SSRF Protection Bypass in vLLMvllm · vllm · CWE-918 | Kritik9,8 | %0,69 Mar 2026 |
36İzleyin | CVE-2026-48746İstismar yok | vLLM: OpenAI auth bypassvllm · vllm · CWE-444 | Kritik9,1 | %1,122 Haz 2026 |
36İzleyin | CVE-2025-29783İstismar yok | vLLM Allows Remote Code Execution via Mooncake Integrationvllm · vllm · CWE-502 | Kritik9,0 | %0,719 Mar 2025 |
36İzleyin | CVE-2026-114053İstismar yok | vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revisionvllm · vllm · CWE-94 | Kritik9,2 | %0,421 Eki 2026 |
35İzleyin | CVE-2026-27893İstismar yok | vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-outvllm · vllm · CWE-693 | Yüksek8,8 | %1,426 Mar 2026 |
35İzleyin | CVE-2025-62164İstismar yok | VLLM deserialization vulnerability leading to DoS and potential RCEvllm · vllm · CWE-20 | Yüksek8,8 | %0,921 Kas 2025 |
35İzleyin | CVE-2025-24357İstismar yok | vLLM allows a malicious model RCE by torch.load in hf_model_weights_iteratorvllm · vllm · CWE-502 | Yüksek8,8 | %0,827 Oca 2025 |
35İzleyin | CVE-2025-66448İstismar yok | vLLM vulnerable to remote code execution via transformers_utils/get_configvllm · vllm · CWE-94 | Yüksek8,8 | %0,71 Ara 2025 |
35İzleyin | CVE-2026-54232İstismar yok | vLLM: Dependency Confusion Vulnerability in vLLM Dockerfilevllm · vllm · CWE-427 | Yüksek8,8 | %0,522 Haz 2026 |
35İzleyin | CVE-2026-115912İstismar yok | vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabledvllm · vllm · CWE-502 | Yüksek8,8 | %0,526 Eki 2026 |
35İzleyin | CVE-2026-116176İstismar yok | vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnectorvllm · vllm · CWE-918 | Yüksek8,8 | %0,325 Eki 2026 |
34İzleyin | CVE-2026-93436İstismar yok | vLLM through 0.29.0 Memory Exhaustion via Rejected Requestsvllm · vllm · CWE-401 | Yüksek8,7 | %0,717 Eyl 2026 |
34İzleyin | CVE-2026-56340İstismar yok | vLLM - Denial of Service via Unvalidated Multimodal Embeddingsvllm · vllm · CWE-20 | Yüksek8,7 | %0,620 Haz 2026 |
34İzleyin | CVE-2026-94626İstismar yok | vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_sizevllm · vllm · CWE-789 | Yüksek8,7 | %0,621 Eyl 2026 |
34İzleyin | CVE-2026-94623İstismar yok | vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failurevllm · vllm · CWE-617 | Yüksek8,7 | %0,621 Eyl 2026 |
34İzleyin | CVE-2026-94622İstismar yok | vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadatavllm · vllm · CWE-248 | Yüksek8,7 | %0,621 Eyl 2026 |
34İzleyin | CVE-2026-94627İstismar yok | vLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer ID Collisionvllm · vllm · CWE-401 | Yüksek8,7 | %0,621 Eyl 2026 |
34İzleyin | CVE-2026-55574İstismar yok | vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backendsvllm · vllm · CWE-1333 | Yüksek8,7 | %0,56 Tem 2026 |
34İzleyin | CVE-2026-93592İstismar yok | vLLM before 0.28.0 Denial of Service via negative token IDvllm · vllm · CWE-129 | Yüksek8,7 | %0,518 Eyl 2026 |
- CVE-2026-2277860Bu hafta
vLLM leaks a heap address when PIL throws an error
KritikCVSS 9,8SilahlaştırılmışEPSS %18vllm · vllm2 Şub 2026
- CVE-2025-3244440Planlayın
vLLM Vulnerable to Remote Code Execution via Mooncake Integration
KritikCVSS 9,8İstismar yokEPSS %1vllm · vllm29 Nis 2025
- CVE-2024-1104140Planlayın
Remote Code Execution in vllm-project/vllm
KritikCVSS 9,8İstismar yokEPSS %1vllm · vllm20 Mar 2025
- CVE-2026-2280739İzleyin
vLLM affected by RCE via auto_map dynamic module loading during model initialization
KritikCVSS 9,8Kavram kanıtıEPSS %0vllm · vllm21 Oca 2026
- CVE-2025-4727739İzleyin
vLLM Allows Remote Code Execution via PyNcclPipe Communication Service
KritikCVSS 9,8İstismar yokEPSS %0vllm · vllm20 May 2025
- CVE-2026-11591539İzleyin
vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE
KritikCVSS 9,8İstismar yokEPSS %0vllm · vllm26 Eki 2026
- CVE-2026-2596039İzleyin
SSRF Protection Bypass in vLLM
KritikCVSS 9,8İstismar yokEPSS %0vllm · vllm9 Mar 2026
- CVE-2026-4874636İzleyin
vLLM: OpenAI auth bypass
KritikCVSS 9,1İstismar yokEPSS %1vllm · vllm22 Haz 2026
- CVE-2025-2978336İzleyin
vLLM Allows Remote Code Execution via Mooncake Integration
KritikCVSS 9,0İstismar yokEPSS %0vllm · vllm19 Mar 2025
- CVE-2026-11405336İzleyin
vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision
KritikCVSS 9,2İstismar yokEPSS %0vllm · vllm21 Eki 2026
- CVE-2026-2789335İzleyin
vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out
YüksekCVSS 8,8İstismar yokEPSS %1vllm · vllm26 Mar 2026
- CVE-2025-6216435İzleyin
VLLM deserialization vulnerability leading to DoS and potential RCE
YüksekCVSS 8,8İstismar yokEPSS %0vllm · vllm21 Kas 2025
- CVE-2025-2435735İzleyin
vLLM allows a malicious model RCE by torch.load in hf_model_weights_iterator
YüksekCVSS 8,8İstismar yokEPSS %0vllm · vllm27 Oca 2025
- CVE-2025-6644835İzleyin
vLLM vulnerable to remote code execution via transformers_utils/get_config
YüksekCVSS 8,8İstismar yokEPSS %0vllm · vllm1 Ara 2025
- CVE-2026-5423235İzleyin
vLLM: Dependency Confusion Vulnerability in vLLM Dockerfile
YüksekCVSS 8,8İstismar yokEPSS %0vllm · vllm22 Haz 2026
- CVE-2026-11591235İzleyin
vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled
YüksekCVSS 8,8İstismar yokEPSS %0vllm · vllm26 Eki 2026
- CVE-2026-11617635İzleyin
vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector
YüksekCVSS 8,8İstismar yokEPSS %0vllm · vllm25 Eki 2026
- CVE-2026-9343634İzleyin
vLLM through 0.29.0 Memory Exhaustion via Rejected Requests
YüksekCVSS 8,7İstismar yokEPSS %0vllm · vllm17 Eyl 2026
- CVE-2026-5634034İzleyin
vLLM - Denial of Service via Unvalidated Multimodal Embeddings
YüksekCVSS 8,7İstismar yokEPSS %0vllm · vllm20 Haz 2026
- CVE-2026-9462634İzleyin
vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_size
YüksekCVSS 8,7İstismar yokEPSS %0vllm · vllm21 Eyl 2026
- CVE-2026-9462334İzleyin
vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failure
YüksekCVSS 8,7İstismar yokEPSS %0vllm · vllm21 Eyl 2026
- CVE-2026-9462234İzleyin
vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata
YüksekCVSS 8,7İstismar yokEPSS %0vllm · vllm21 Eyl 2026
- CVE-2026-9462734İzleyin
vLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer ID Collision
YüksekCVSS 8,7İstismar yokEPSS %0vllm · vllm21 Eyl 2026
- CVE-2026-5557434İzleyin
vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends
YüksekCVSS 8,7İstismar yokEPSS %0vllm · vllm6 Tem 2026
- CVE-2026-9359234İzleyin
vLLM before 0.28.0 Denial of Service via negative token ID
YüksekCVSS 8,7İstismar yokEPSS %0vllm · vllm18 Eyl 2026