Tagged “osv”

CVEs tagged osv, newest first.

7107 CVEsRSS

MAL-2026-18301Critical⚠ Exploited

1w ago

vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassi…

vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust gRPC frontend. Attackers can send Generate or GenerateStream…

▾ Twilightvllm · vllmEPSS 0.34%via OSV

CVE-2026-116178High· 7.5

1w ago

vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inc…

vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the disaggregated /inference/v1/generate endpoint. Attackers can re…

▾ Twilightvllm · vllmEPSS 0.33%via OSV

CVE-2026-116177High· 7.5

1w ago

vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass

vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None. Attackers …

▾ Twilightvllm-project · vllmEPSS 0.29%via CVEORG

CVE-2026-116176High· 8.2

1w ago

vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector

vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector pref…

▾ Twilightvllm-project · vllmEPSS 0.32%via CVEORG

RUSTSEC-2026-0409None

1w ago

Use-after-free from a comparator that answers inconsistently

▾ Sunlitskiplist · skiplistvia OSV

RUSTSEC-2026-0408None

Tagged “osv”

Malicious code in dictmerge-lite (PyPI)

Malicious code in claudeopusenifile (PyPI)

Malicious code in claudeopuseni (PyPI)

Malicious code in claudeopusfile (PyPI)

Malicious code in nebulallm (PyPI)

Malicious code in zagents-message-bus (PyPI)

Malicious code in fontus (PyPI)

vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassi…

vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inc…

vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass

vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector

Use-after-free from a comparator that answers inconsistently

Aliasing violations in splice, mutable iteration and cursors

Multiple timing variability issues in operations intended to be constant-time

Malicious code in sitecard (PyPI)

Malicious code in workslip (PyPI)

Malicious code in thornqueue (PyPI)

Malicious code in thistlerun (PyPI)

Malicious code in taskquay (PyPI)

Malicious code in slatejob (PyPI)

Malicious code in sedgehaul (PyPI)

Malicious code in runpier (PyPI)

Malicious code in reedworker (PyPI)

Malicious code in otterload (PyPI)

Malicious code in marshrunner (PyPI)

Malicious code in loadferry (PyPI)

Malicious code in larchworker (PyPI)

Malicious code in juniperrun (PyPI)

Malicious code in jobwharf (PyPI)

Malicious code in flintqueue (PyPI)