CVE-2026-100653

The vLLM inference engine (versions 0.22.1 through 0.28.0) contains a supply-chain integrity and reproducibility failure. The system fails to propagate operator-supplied model revision pins (--revision / --code-revision) to specific Hugging Face artifacts for the FunAudioChat and Tarsier2 archite...

PT-2026-99324

Name of the Vulnerable Software and Affected Versions vLLM versions 0.22.1 through 0.27.9 Description A supply-chain integrity and reproducibility issue exists where the model revision pin provided via --revision or --code-revision is not propagated to specific Hugging Face artifact loads for...