GHSA-7WX4-6VFF-V64P vulnerabilities

Vulnerabilities for packages: py3-diffusers-cuda-12.9, py3-diffusers-cuda-13.0...

Critical: Red Hat Security Advisory: Red Hat AI Inference Server 3.3.5 (CUDA)

Red Hat AI Inference Server 3.3.5 CUDA is now available. Red Hat® AI Inference Server...

CVE-2026-48746 vulnerabilities

Vulnerabilities for packages: py3-vllm-cuda-13.0, py3-vllm-cuda-12.9, py3-vllm-cuda-12.4, vllm-openai-cuda-12.9, tritonserver-backend-vllm-cuda-13.0...

GHSA-94F4-HR76-P5J6 vulnerabilities

Vulnerabilities for packages: py3-vllm-cuda-13.0, py3-vllm-cuda-12.9, py3-vllm-cuda-12.4, vllm-openai-cuda-12.9, tritonserver-backend-vllm-cuda-13.0...

GHSA-6V7P-G79W-8964 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, openstack-glance-2025.1, wazuh-manager, nvidia-nsight-compute-13.3, openstack-kolla-toolbox-2025.2-fips, dbt-bigquery, openstack-glance-2026.1-fips, py3-hashin, openstack-keystone-2025.2-fips, datadog-agent-fips, openstack-glance-2025.1-fips,...

GHSA-4XGF-CPJX-PC3J vulnerabilities

Vulnerabilities for packages: lmcache-cuda-12.8, azureml-inference-server-http-fips, prefect, open-webui, tritonserver-backend-vllm-cuda-13.0, vllm-openai-cuda-13.0, airflow-postgres-fips, litellm, airflow-core, azureml-inference-server-http, airflow, mcp-atlassian, prefect-fips,...

CVE-2026-54235

vLLM is an inference and serving engine for large language models LLMs. Prior to 0.23.1rc0, ll temperature validation gates use comparison operators , which silently evaluate to False for NaN and for positive Infinity in Python's IEEE 754 float semantics. Both values pass every guard and propagat...

CVE-2026-54235 vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels

vLLM is an inference and serving engine for large language models LLMs. Prior to 0.23.1rc0, ll temperature validation gates use comparison operators , which silently evaluate to False for NaN and for positive Infinity in Python's IEEE 754 float semantics. Both values pass every guard and propagat...

CVE-2026-54235: Improper Validation of Specified Type of Input

vLLM is an inference and serving engine for large language models LLMs. Prior to 0.23.1rc0, ll temperature validation gates use comparison operators , which silently evaluate to False for NaN and for positive Infinity in Python's IEEE 754 float semantics. Both values pass every guard and propagat...

CVE-2026-50269 vulnerabilities

Vulnerabilities for packages: lmcache-cuda-12.8, py3-vllm-cuda-12.9, py3-vllm-cuda-13.0, py3-vllm-cuda-12.4, airflow-core, airflow, py3.13-scanner-test-libraries-aiohttp, tritonserver-backend-vllm-cuda-12.9...

GHSA-M6QW-4CW2-HM4M vulnerabilities

Vulnerabilities for packages: lmcache-cuda-12.8, py3-vllm-cuda-12.9, py3-vllm-cuda-13.0, py3-vllm-cuda-12.4, airflow-core, airflow, py3.13-scanner-test-libraries-aiohttp, tritonserver-backend-vllm-cuda-12.9...

vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving

Summary Integer truncation of tensor dimensions in vLLM's GGUF dequantize kernels csrc/quantization/gguf/ggufkernel.cu causes partial tensor processing. The output tensor is allocated at full size via torch::empty uninitialized memory, but the dequantize CUDA kernel processes only a truncated...

CVE-2026-53540 vulnerabilities

Vulnerabilities for packages: wazuh-manager, wazuh-manager-fips, litellm, airflow-postgres-fips, airflow-core, airflow, tritonserver-backend-vllm-cuda-12.9...

GHSA-V9PG-7XVM-68HF vulnerabilities

Vulnerabilities for packages: wazuh-manager, wazuh-manager-fips, litellm, airflow-postgres-fips, airflow-core, airflow, tritonserver-backend-vllm-cuda-12.9...

GHSA-6JV3-5F52-599M vulnerabilities

Vulnerabilities for packages: wazuh-manager, wazuh-manager-fips, litellm, airflow-postgres-fips, airflow-core, airflow, tritonserver-backend-vllm-cuda-12.9...

CVE-2026-53537 vulnerabilities

Vulnerabilities for packages: wazuh-manager, wazuh-manager-fips, litellm, airflow-postgres-fips, airflow-core, airflow, tritonserver-backend-vllm-cuda-12.9...

CVE-2026-53539 vulnerabilities

Vulnerabilities for packages: wazuh-manager, wazuh-manager-fips, litellm, airflow-postgres-fips, airflow-core, airflow, tritonserver-backend-vllm-cuda-12.9...

GHSA-JP82-JPQV-5VV3 vulnerabilities

Vulnerabilities for packages: prefect, kserve, litellm, airflow-postgres-fips, airflow-core, mlflow-fips, airflow, prefect-fips, tritonserver-backend-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-13.0, mlflow, semgrep, nemo...

CVE-2026-54282 vulnerabilities

Vulnerabilities for packages: prefect, kserve, litellm, airflow-postgres-fips, airflow-core, mlflow-fips, airflow, prefect-fips, tritonserver-backend-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-13.0, mlflow, semgrep, nemo...

CVE-2026-54283 vulnerabilities

Vulnerabilities for packages: prefect, kserve, litellm, airflow-postgres-fips, airflow-core, mlflow-fips, airflow, prefect-fips, tritonserver-backend-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-13.0, mlflow, semgrep, nemo...