Vulnerabilities in vllm-project
51 resultsVexday analysis
O vllm-project apresenta volume moderado de vulnerabilidades (51 CVEs) com concentração recente: 18 divulgadas nos últimos 90 dias. A fraqueza dominante (CWE-502 - Desserialização de dados não confiáveis) afeta 7 casos críticos, porém nenhuma vulnerabilidade está sob exploração ativa documentada (KEV). O risco é significativo pela cadência de descobertas recentes e pela natureza das falhas de desserialização, que tipicamente permitem execução remota de código.
CVE-2026-22778CRITICALvLLM leaks a heap address when PIL throws an errorEPSS 3.7%CVE-2025-32444CRITICALvLLM Vulnerable to Remote Code Execution via Mooncake IntegrationEPSS 1.7%CVE-2024-11041CRITICALRemote Code Execution in vllm-project/vllmEPSS 1.4%CVE-2026-27893HIGHvLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-outEPSS 1.3%CVE-2024-9053CRITICALRemote Code Execution in vllm-project/vllmEPSS 1.3%CVE-2026-48746CRITICALvLLM: OpenAI auth bypassEPSS 1.2%CVE-2025-47277CRITICALvLLM Allows Remote Code Execution via PyNcclPipe Communication ServiceEPSS 0.9%CVE-2025-62164HIGHVLLM deserialization vulnerability leading to DoS and potential RCEEPSS 0.9%CVE-2026-54236MEDIUMvLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic routerEPSS 0.8%CVE-2026-4944HIGHHardcoded trust_remote_code=True in vllm-project/vllm Bypasses User Security ControlEPSS 0.7%CVE-2026-41523HIGHvLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code ExecutionEPSS 0.7%CVE-2025-29783CRITICALvLLM Allows Remote Code Execution via Mooncake IntegrationEPSS 0.7%CVE-2026-22807HIGHvLLM affected by RCE via auto_map dynamic module loading during model initializationEPSS 0.7%CVE-2025-24357HIGHvLLM allows a malicious model RCE by torch.load in hf_model_weights_iteratorEPSS 0.7%CVE-2025-66448HIGHvLLM vulnerable to remote code execution via transformers_utils/get_configEPSS 0.7%CVE-2025-30202HIGHData exposure via ZeroMQ on multi-node vLLM deploymentEPSS 0.6%CVE-2026-54232HIGHvLLM: Dependency Confusion Vulnerability in vLLM DockerfileEPSS 0.6%CVE-2025-48956HIGHvLLM API endpoints vulnerable to Denial of Service AttacksEPSS 0.6%CVE-2026-25960HIGHSSRF Protection Bypass in vLLMEPSS 0.5%CVE-2026-5497HIGHUnbounded Frame Count in video/jpeg Base64 Data URL Processing Leads to OOM DoS in vllm-project/vllmEPSS 0.5%