GHSA-4R2X-XPJR-7CVV vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-13.0...

CVE-2026-22778 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-13.0...

CVE-2026-24779 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-13.0...

GHSA-GRG2-63FW-F2QR vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-13.0...

GHSA-QH4C-XF7M-GXFC vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-13.0...

GHSA-3C37-WWVX-H642 vulnerabilities

Vulnerabilities for packages: localstack, py3-cbor2, tritonserver-backend-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-13.0, vllm-openai-cuda-12.9, py3-vllm-cuda-12.4...

CVE-2026-26209 vulnerabilities

Vulnerabilities for packages: localstack, py3-cbor2, tritonserver-backend-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-13.0, vllm-openai-cuda-12.9, py3-vllm-cuda-12.4...

PYSEC-2026-2297

vLLM is an inference and serving engine for large language models LLMs. Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode trustremotecode=True when loading sub-components, bypassing the user's explicit --trust-remote-code=False security opt-out. This...

PYSEC-2026-2297

vLLM is an inference and serving engine for large language models LLMs. Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode trustremotecode=True when loading sub-components, bypassing the user's explicit --trust-remote-code=False security opt-out. This...

vLLM 安全漏洞

vLLM is an open-source LLM-based inference and service engine that features high throughput and efficient memory usage. Versions of vLLM prior to 0.10.1 to 0.18.0 contained a security vulnerability. This vulnerability stemmed from the hardcoding of trustremotecode=True in two model implementation...

CVE-2026-27893

vLLM is an inference and serving engine for large language models LLMs. Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode trustremotecode=True when loading sub-components, bypassing the user's explicit --trust-remote-code=False security opt-out. This...

CVE-2026-27893 vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out

vLLM is an inference and serving engine for large language models LLMs. Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode trustremotecode=True when loading sub-components, bypassing the user's explicit --trust-remote-code=False security opt-out. This...

CVE-2026-27893 vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out

vLLM is an inference and serving engine for large language models LLMs. Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode trustremotecode=True when loading sub-components, bypassing the user's explicit --trust-remote-code=False security opt-out. This...

PT-2026-28373

Name of the Vulnerable Software and Affected Versions vLLM versions 0.10.1 through 0.17.x Description vLLM is an inference and serving engine for large language models LLMs. Starting with version 0.10.1 and continuing through version 0.17.x, two model implementation files hardcode trust remote...

CVE-2026-27893: Protection Mechanism Failure

vLLM is an inference and serving engine for large language models LLMs. Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode trustremotecode=True when loading sub-components, bypassing the user's explicit --trust-remote-code=False security opt-out. This...

The vulnerability of the MultiModalHasher class in the library for working with Large Language Models (LLMs) allows a hacker to disclose protected information.

The vulnerability of the MultiModalHasher class in the library for working with Large Language Models LLMs vLLM is related to improper verification of consistency in input data. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information that is protected by this...

CVE-2026-25048 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, vllm-openai-cuda-12.9, py3-vllm-cuda-12.4, tritonserver-backend-vllm-cuda-13.0...

GHSA-7RGV-GQHR-FXG3 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, vllm-openai-cuda-12.9, py3-vllm-cuda-12.4, tritonserver-backend-vllm-cuda-13.0...

Server-side Request Forgery (SSRF)

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via inconsistent URL parsing between the validation layer and the HTTP client in the loadfromurl and loadfromurlasy...

CVE-2026-25960

vLLM is an inference and serving engine for large language models LLMs. The SSRF protection fix for CVE-2026-24779 add in 0.15.1 can be bypassed in the loadfromurlasync method due to inconsistent URL parsing behavior between the validation layer and the actual HTTP client. The SSRF fix uses...