How many vLLM vllm-project/vllm CVEs are in CISA KEV?

None of vLLM vllm-project/vllm's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of vLLM vllm-project/vllm are affected?

3 distinct vLLM vllm-project/vllm versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in vLLM vllm-project/vllm CVEs?

vLLM vllm-project/vllm's CVEs most often map to these CWE weakness types: CWE-502 (Deserialization of Untrusted Data), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-400 (Uncontrolled Resource Consumption).

How many critical vLLM vllm-project/vllm vulnerabilities are there?

vLLM vllm-project/vllm has 2 critical and 2 high-severity CVEs.

What is the average severity of vLLM vllm-project/vllm CVEs?

The average CVSS base score across vLLM vllm-project/vllm's scored CVEs is 9.0.

vLLM vllm-project/vllm Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: vLLM vllm-project/vllm vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

RadicalNotion.AI

Overview

vLLM vllm-project/vllm has 4 published CVE records since 2025, of which none are in CISA's KEV catalog and 4 have a known public exploit. The average CVSS base score across scored CVEs is 9.0.

Severity and exploitation

How the CVSS severity of vLLM vllm-project/vllm's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical2

High2

Medium0

Low0

In CISA’s Known Exploited Vulnerabilities catalog

None of vLLM vllm-project/vllm's CVEs are currently listed in CISA's KEV catalog.

Public exploits

4 of vLLM vllm-project/vllm's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every vLLM vllm-project/vllm version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

<= latest3 CVEs
< 0.19.01 CVE

Fixed in

0.19.01 CVE

Find a version

4 CVEs

Sort

Unbounded Frame Count in video/jpeg Base64 Data URL Processing Leads to OOM DoS in vllm-project/vllm
CVE-2026-5497
Public exploit
Patch
CWE-400
High · CVSS 7.5
EPSS 0.5% (45th pct)2026-06-11
Hardcoded trust_remote_code=True in vllm-project/vllm Bypasses User Security Control
CVE-2026-4944
Public exploit
Workaround
CWE-22
High · CVSS 8.8
EPSS 0.7% (55th pct)2026-05-28
Remote Code Execution in vllm-project/vllm
CVE-2024-11041
Public exploit
CWE-502
Critical · CVSS 9.8
EPSS 1.7% (78th pct)2025-03-20
Remote Code Execution in vllm-project/vllm
CVE-2024-9053
Public exploit
CWE-502
Critical · CVSS 9.8
EPSS 1.4% (72th pct)2025-03-20

Common weakness types

The CWE weakness categories most often found in vLLM vllm-project/vllm CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many vLLM vllm-project/vllm CVEs were published each year.

2025

2026

Other vLLM products

Browse vulnerabilities for other products by vLLM.

vLLM135 CVEs AIBrix1 CVE vllm-gaudi1 CVE

All vLLM vulnerabilities

Frequently asked questions

Common questions about vLLM vllm-project/vllm vulnerabilities.

How many CVEs does vLLM vllm-project/vllm have?: vLLM vllm-project/vllm has 4 published CVE records since 2025.
How many vLLM vllm-project/vllm CVEs are in CISA KEV?: None of vLLM vllm-project/vllm's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for vLLM vllm-project/vllm vulnerabilities?: Yes — 4 of vLLM vllm-project/vllm's CVEs have a known public exploit.
Which versions of vLLM vllm-project/vllm are affected?: 3 distinct vLLM vllm-project/vllm versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in vLLM vllm-project/vllm CVEs?: vLLM vllm-project/vllm's CVEs most often map to these CWE weakness types: CWE-502 (Deserialization of Untrusted Data), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-400 (Uncontrolled Resource Consumption).
How many critical vLLM vllm-project/vllm vulnerabilities are there?: vLLM vllm-project/vllm has 2 critical and 2 high-severity CVEs.
What is the average severity of vLLM vllm-project/vllm CVEs?: The average CVSS base score across vLLM vllm-project/vllm's scored CVEs is 9.0.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track vLLM vllm-project/vllm vulnerabilities

Get an alert for each new vLLM vllm-project/vllm CVE, with AI-written analysis and remediation steps.

Create an account See pricing