CVE-2026-54282 vulnerabilities

Vulnerabilities for packages: mlflow, tritonserver-backend-vllm-cuda-13.0, airflow-core, mlflow-fips, semgrep, airflow, tritonserver-backend-vllm-cuda-12.9, litellm, kserve, nemo, airflow-postgres-fips, prefect, prefect-fips...

GHSA-JP82-JPQV-5VV3 vulnerabilities

Vulnerabilities for packages: mlflow, tritonserver-backend-vllm-cuda-13.0, airflow-core, mlflow-fips, semgrep, airflow, tritonserver-backend-vllm-cuda-12.9, litellm, kserve, nemo, airflow-postgres-fips, prefect, prefect-fips...

CVE-2026-54279 vulnerabilities

Vulnerabilities for packages: metaflow-service-fips, apache-beam-python-3.11-sdk, mlflow, airflow-core, mlflow-fips, text-generation-inference, awx, py3-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-12.9, authentik-fips, apache-beam-python-3.12-sdk, lmcache-cuda-12.8, airflow,...

GHSA-XCGM-R5H9-7989 vulnerabilities

Vulnerabilities for packages: metaflow-service-fips, apache-beam-python-3.11-sdk, mlflow, airflow-core, mlflow-fips, text-generation-inference, awx, py3-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-12.9, authentik-fips, apache-beam-python-3.12-sdk, lmcache-cuda-12.8, airflow,...

CVE-2026-54273 vulnerabilities

Vulnerabilities for packages: metaflow-service-fips, apache-beam-python-3.11-sdk, mlflow, airflow-core, mlflow-fips, text-generation-inference, awx, py3-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-12.9, authentik-fips, apache-beam-python-3.12-sdk, lmcache-cuda-12.8, airflow,...

CVE-2026-54274 vulnerabilities

Vulnerabilities for packages: metaflow-service-fips, apache-beam-python-3.11-sdk, mlflow, airflow-core, mlflow-fips, text-generation-inference, awx, py3-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-12.9, authentik-fips, apache-beam-python-3.12-sdk, lmcache-cuda-12.8, airflow,...

CVE-2026-54276 vulnerabilities

Vulnerabilities for packages: metaflow-service-fips, apache-beam-python-3.11-sdk, mlflow, airflow-core, mlflow-fips, text-generation-inference, awx, py3-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-12.9, authentik-fips, apache-beam-python-3.12-sdk, lmcache-cuda-12.8, airflow,...

CVE-2026-54280 vulnerabilities

Vulnerabilities for packages: metaflow-service-fips, apache-beam-python-3.11-sdk, mlflow, airflow-core, mlflow-fips, text-generation-inference, awx, py3-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-12.9, authentik-fips, apache-beam-python-3.12-sdk, lmcache-cuda-12.8, airflow,...

GHSA-63HW-FMQ6-XXG2 vulnerabilities

Vulnerabilities for packages: metaflow-service-fips, apache-beam-python-3.11-sdk, mlflow, airflow-core, mlflow-fips, text-generation-inference, awx, py3-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-12.9, authentik-fips, apache-beam-python-3.12-sdk, lmcache-cuda-12.8, airflow,...

GHSA-HPJ7-WQ8M-9HGP vulnerabilities

Vulnerabilities for packages: metaflow-service-fips, apache-beam-python-3.11-sdk, mlflow, airflow-core, mlflow-fips, text-generation-inference, awx, py3-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-12.9, authentik-fips, apache-beam-python-3.12-sdk, lmcache-cuda-12.8, airflow,...

CVE-2026-54275 vulnerabilities

Vulnerabilities for packages: metaflow-service-fips, apache-beam-python-3.11-sdk, mlflow, airflow-core, mlflow-fips, text-generation-inference, awx, py3-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-12.9, authentik-fips, apache-beam-python-3.12-sdk, lmcache-cuda-12.8, airflow,...

CVE-2026-54277 vulnerabilities

Vulnerabilities for packages: metaflow-service-fips, apache-beam-python-3.11-sdk, mlflow, airflow-core, mlflow-fips, text-generation-inference, awx, py3-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-12.9, authentik-fips, apache-beam-python-3.12-sdk, lmcache-cuda-12.8, airflow,...

GHSA-4FVR-RGM6-GQMC vulnerabilities

Vulnerabilities for packages: metaflow-service-fips, apache-beam-python-3.11-sdk, mlflow, airflow-core, mlflow-fips, text-generation-inference, awx, py3-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-12.9, authentik-fips, apache-beam-python-3.12-sdk, lmcache-cuda-12.8, airflow,...

GHSA-9X8Q-7H8H-WCW9 vulnerabilities

Vulnerabilities for packages: metaflow-service-fips, apache-beam-python-3.11-sdk, mlflow, airflow-core, mlflow-fips, text-generation-inference, awx, py3-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-12.9, authentik-fips, apache-beam-python-3.12-sdk, lmcache-cuda-12.8, airflow,...

GHSA-537C-GMF6-5CCF vulnerabilities

Vulnerabilities for packages: openstack-placement-2025.2, apache-beam-python-3.11-sdk, crossplane-function-pythonic, mlflow, openstack-keystone-2026.1, kubeflow-pipelines-visualization-server, gitlab-cng-fips, gitlab-cng, airflow-core, opal, openstack-nova-2026.1, openstack-horizon-2025.2,...

GHSA-94F4-HR76-P5J6 vLLM: OpenAI auth bypass

Summary A vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware, which was discovered during @x41sec's source code audit. It allows to use the API without providing the configured VLLMAPIKEY or...

vLLM: OpenAI auth bypass

Summary A vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware, which was discovered during @x41sec's source code audit. It allows to use the API without providing the configured VLLMAPIKEY or...

HTTP Request Smuggling

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to HTTP Request Smuggling via improper validation of the Host header in the request scope. An attacker can gain unauthorized access to API endpoints by...

vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution

Summary An assert-based security check in vLLM's activation function loading allows any unauthenticated attacker to achieve arbitrary code execution on the server by publishing a malicious HuggingFace model, when vLLM runs in Python optimized mode python -O or PYTHONOPTIMIZE=1. Details vLLM uses ...

CVE-2026-5497

A flaw was found in vLLM. An attacker can exploit this vulnerability by sending a specially crafted API request containing an excessive number of base64-encoded JPEG frames within a data URL. This unbounded processing of frames in the VideoMediaIO.loadbase64 method leads to an Out-of-Memory OOM...