CVE-2026-100652

vLLM versions 0.22.0 through 0.23.0 fail to validate stoptokenids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with mintokens greater than zero and out-of-vocabulary stoptokenids to...

PT-2026-99323

Name of the Vulnerable Software and Affected Versions vLLM versions 0.22.0 through 0.23.0 Description The Rust HTTP and gRPC frontends fail to validate stop token ids against vocabulary bounds, allowing out-of-vocabulary token IDs to reach the MinTokensLogitsProcessor function. An attacker can...

ai-vocabulary-builder (>=0.8.0, <=1.4.3), pdm (>=2.0.0a1, <=2.0.0b1) potentially affected by CVE-2026-73030 via unearth (>=0.4.1, <=0.17.5)

unearth PYPI version =0.4.1, =0.8.0, =2.0.0a1, =2.0.0b1 Source cves: CVE-2026-73030 Source advisory: SNYK:PYTHON-UNEARTH-18610067...

CVE-2026-43632 llama.cpp b7492–b9060 Use-After-Free in Tokenization Endpoints

llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in llama-server affecting six tokenization endpoints /tokenize, /detokenize, /infill, /apply-template, /rerank, and /anthropic/counttokens that bypass the task queue and access ctxserver.vocab directly on HTTP...

PYSEC-2026-3542 vLLM has Remote DoS via Invalid Recovered Token Reinjection

Summary A frontend-legal multi-request speculative workload can make vLLM produce an out-of-vocabulary recovered token equal to vocabsize, convert that value to -1 when choosing the next live token for a request, and then feed that -1 back into the next drafter input ids. On Qwen3 GPTQ this reach...

build-vocabulary (0.1.8) potentially affected by CVE-2026-59890 via setuptools (40.6.0)

setuptools PYPI version 40.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - build-vocabulary 0.1.8 Source cves: CVE-2026-59890 Source advisory: OSV:GHSA-H35F-9H28-MQ5C...

Find Before You Fine-Tune: A Diagnostic Study of Small LLMs for Cybersecurity QA

Large Language Models LLMs are increasingly fine-tuned for critical-domain Question-Answering QA, yet choosing which small model to adapt, before paying the cost of adaptation, remains difficult. Fine-tuning can improve domain alignment, but it may also erode prior knowledge, weaken...

EUVD-2026-41921

vLLM has Remote DoS via Invalid Recovered Token Reinjection...

GHSA-8WR5-JM2H-8R4F vLLM has Remote DoS via Invalid Recovered Token Reinjection

Summary A frontend-legal multi-request speculative workload can make vLLM produce an out-of-vocabulary recovered token equal to vocabsize, convert that value to -1 when choosing the next live token for a request, and then feed that -1 back into the next drafter input ids. On Qwen3 GPTQ this reach...

build-vocabulary (0.1.8) potentially affected by CVE-2026-59890 via setuptools (40.6.0)

setuptools PYPI version 40.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - build-vocabulary 0.1.8 Source cves: CVE-2026-59890 Source advisory: OSV:PYSEC-2026-3447...

PYSEC-2026-1487 Keras is vulnerable to arbitrary local file loading and Server-Side Request Forgery

The Keras.Model.loadmodel method, including when executed with the intended security mitigation safemode=True, is vulnerable to arbitrary local file loading and Server-Side Request Forgery SSRF. This vulnerability stems from the way the StringLookup layer is handled during model loading from a...

CVE-2026-54234

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal multi-request speculative decoding workload can cause the rejection sampler to produce a recovered token equal to the model vocabulary size boundary value, which is then convert...

PT-2026-55997

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.24.0 Description A flaw in the rejection sampler during multi-request speculative decoding workloads allows the production of a recovered token equal to the model vocabulary size boundary value. This value is converted...

CVE-2026-13503

A vulnerability was detected in antlr ANTLR4 up to 4.13.2. Affected by this issue is the function getImportedVocabFile of the file tool/src/org/antlr/v4/parse/TokenVocabParser.java of the component tokenVocab Grammar Option Handler. The manipulation results in path traversal. The attack can be...

CVE-2026-13503 antlr ANTLR4 tokenVocab Grammar Option TokenVocabParser.java getImportedVocabFile path traversal

A vulnerability was detected in antlr ANTLR4 up to 4.13.2. Affected by this issue is the function getImportedVocabFile of the file tool/src/org/antlr/v4/parse/TokenVocabParser.java of the component tokenVocab Grammar Option Handler. The manipulation results in path traversal. The attack can be...

PT-2026-53114

Name of the Vulnerable Software and Affected Versions ANTLR4 versions prior to 4.13.3 Description An issue exists in the tokenVocab Grammar Option Handler where the getImportedVocabFile function in the tool/src/org/antlr/v4/parse/TokenVocabParser.java file is susceptible to path traversal. This...

PT-2026-48591

Name of the Vulnerable Software and Affected Versions Drupal Tagify versions 0.0.0 through 1.2.52 Description Stored Cross-site Scripting XSS occurs because the module fails to properly sanitize the name of parent taxonomy terms when rendering suggestions in the Tagify dropdown. This allows an...

[SECURITY] Fedora 44 Update: sentencepiece-0.2.1-1.fc44

The SentencePiece is an unsupervised text tokenizer for Neural Network-based text generation. It is an unsupervised text tokenizer and detokenizer mainly for Neural Network-based text generation systems where the vocabulary size is predetermined prior to the neural model training. SentencePiece...

Terminus-ai

Terminus-ai a foundation model trainthe entirety of exploit-...

MAI-2024-0032

Large Language Models LLMs are susceptible to a sophisticated vocabulary-based attack, wherein strategically chosen words from the model's vocabulary are inserted into user prompts. These words are selected through an optimization process utilizing embeddings from another LLM. This technique can...