CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago (Oct 29, 2026, 3:23 PM ET)

What this means for you

This week: 3,225 CVEs published, 237 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stackFree account, 3 products This week's critical CVEs Exploited in the last 30 days

Published in the last 7 days: 3,225; Show in the list
Critical, last 7 days: 237; Show in the list
Healthcare-tagged, last 7 days: 6; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product vllm:vllm. Show all products

95 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2026-115918	Medium 6.5	vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs Assigned by GitHub_M	Oct 26, 2026
CVE-2026-115917	Low 3.4	vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server Assigned by GitHub_M	Oct 26, 2026
CVE-2026-115916	Medium 6.5	vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS) Assigned by GitHub_M	Oct 26, 2026
CVE-2026-115915	High 8.1	vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE Assigned by GitHub_M	Oct 26, 2026
CVE-2026-115914	Medium 6.5	vLLM DeepSeek-OCR image processing vulnerable to denial of service Assigned by GitHub_M	Oct 26, 2026
CVE-2026-115913	Medium 6.5	vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine Assigned by GitHub_M	Oct 26, 2026
CVE-2026-115912	High 7.5	vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled Assigned by GitHub_M	Oct 26, 2026
CVE-2026-115911	Medium 6.5	vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool Assigned by GitHub_M	Oct 26, 2026
CVE-2026-116181	Medium 6.5	vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_ids Assigned by VulnCheck	Oct 25, 2026
CVE-2026-116180	High 7.7	vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors Assigned by VulnCheck	Oct 25, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.