PyPI vllm

Name: PyPI vllm
Brand: PyPI

productUS

pkg:pypi/vllm

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

4critical24high12medium0low

updated 2026-10-27

vulnerabilities (98)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-22778US	—	18.5% (97th)	Exploit	0.14.1	2026-02-02	0.8.3 → 0.14.1
CVE-2026-22807US	critical9.8	0.98% (62nd)	Exploit	0.14.0	2026-01-21	0.10.1 → 0.14.0
CVE-2026-34753US	—	0.25% (16th)	Exploit	0.19.0	2026-04-06	0.16.0 → 0.19.0
CVE-2025-32444US	critical9.8	1.79% (78th)	—	0.8.5	2025-04-30	0.6.5 → 0.8.5
CVE-2024-11041US	—	1.72% (77th)	—	no fix	2025-03-20	≤ 0.6.2
CVE-2024-9053US	critical9.8	1.38% (72nd)	—	no fix	2025-03-20	≤ 0.6.0
CVE-2026-27893US	—	1.37% (72nd)	—	0.18.0	2026-03-27	0.10.1 → 0.18.0
CVE-2026-48746US	—	1.15% (67th)	—	0.22.0	2026-06-22	0.3.0 → 0.22.0
CVE-2025-47277US	—	0.96% (61st)	—	0.8.5	2025-05-20	0.6.5 → 0.8.5
CVE-2025-62164US	—	0.96% (61st)	—	0.11.1	2025-11-21	0.10.2 → 0.11.1
CVE-2026-54236US	—	0.93% (60th)	—	0.24.0	2026-06-22	2 versions
CVE-2026-41523US	—	0.91% (60th)	—	0.22.0	2026-06-22	< 0.22.0
CVE-2025-24357US	high8.8	0.87% (58th)	—	0.7.0	2025-01-27	< 0.7.0
CVE-2026-100650US	medium6.5	0.81% (57th)	—	0.30.0	2026-09-26	< 0.30.0
CVE-2026-93436US	high7.5	0.76% (55th)	—	0.30.0	2026-09-17	< 0.30.0
CVE-2025-29783US	—	0.73% (54th)	—	0.8.0	2025-03-19	0.6.5 → 0.8.0
CVE-2026-57173US	—	0.73% (54th)	—	0.24.0	2026-09-16	< 0.24.0
CVE-2026-103241US	high7.5	0.71% (53rd)	—	0.27.0	2026-09-30	< 0.27.0
CVE-2024-8768US	—	0.68% (52nd)	—	0.5.5	2024-09-17	< 0.5.5
CVE-2026-55514US	medium6.5	0.66% (52nd)	—	0.24.0	2026-07-06	0.12.0 → 0.24.0
CVE-2025-66448US	high8.8	0.66% (51st)	—	0.11.1	2025-12-01	< 0.11.1
CVE-2026-56340US	high7.5	0.64% (51st)	—	0.13.0	2026-06-20	0.10.2 → 0.13.0
CVE-2025-48944US	—	0.64% (50th)	—	0.9.0	2025-05-30	0.8.0 → 0.9.0
CVE-2026-94626US	high7.5	0.63% (50th)	—	0.30.0	2026-09-21	< 0.30.0
CVE-2026-94624US	high7.5	0.63% (50th)	—	0.30.0	2026-09-21	< 0.30.0
CVE-2026-94623US	high7.5	0.63% (50th)	—	0.30.0	2026-09-21	< 0.30.0
CVE-2026-94622US	high7.5	0.63% (50th)	—	0.30.0	2026-09-21	< 0.30.0
CVE-2026-54234US	—	0.62% (49th)	—	0.24.0	2026-07-06	0.17.1 → 0.24.0
CVE-2026-78684US	medium5.3	0.61% (49th)	—	0.27.0	2026-08-25	< 0.27.0
CVE-2025-30202US	high7.5	0.60% (48th)	—	0.8.5	2025-04-30	0.5.2 → 0.8.5
CVE-2026-55574US	high7.5	0.58% (48th)	—	0.24.0	2026-07-06	< 0.24.0
CVE-2026-69147US	—	0.58% (48th)	—	0.28.0	2026-09-16	< 0.28.0
CVE-2026-73559US	—	0.58% (48th)	—	0.26.0	2026-08-13	0.19.0 → 0.26.0
CVE-2026-24779US	—	0.58% (47th)	—	0.14.1	2026-01-27	< 0.14.1
CVE-2025-48942US	—	0.57% (47th)	—	0.9.0	2025-05-30	0.8.0 → 0.9.0
CVE-2026-25960US	critical9.8	0.57% (47th)	—	0.17.0	2026-03-09	0.15.1 → 0.17.0
CVE-2025-59425US	—	0.57% (47th)	—	0.11.0	2025-10-07	< 0.11.0
CVE-2025-48956US	—	0.56% (47th)	—	0.10.1.1	2025-08-21	0.1.0 → 0.10.1.1
CVE-2026-54232US	—	0.56% (47th)	—	0.22.1	2026-06-22	< 0.22.1
CVE-2025-30165US	—	0.56% (46th)	—	0.10.0	2025-05-06	0.5.2 → 0.10.0
CVE-2026-93592US	high7.5	0.54% (45th)	—	0.28.0	2026-09-18	< 0.28.0
CVE-2025-48887US	—	0.54% (45th)	—	0.9.0	2025-05-30	0.6.4 → 0.9.0
CVE-2025-62426US	—	0.54% (45th)	—	0.11.1	2025-11-21	0.5.5 → 0.11.1
CVE-2026-5497US	—	0.54% (45th)	—	0.19.0	2026-06-11	0.8.0 → 0.19.0
CVE-2025-46560US	high7.5	0.52% (44th)	—	0.8.5	2025-04-30	0.8.0 → 0.8.5
CVE-2026-94625US	medium5.3	0.52% (44th)	—	0.30.0	2026-09-21	< 0.30.0
CVE-2026-55646US	—	0.52% (44th)	—	0.24.0	2026-07-06	0.22.0 → 0.24.0
CVE-2026-73556US	—	0.52% (44th)	—	0.26.0	2026-08-13	< 0.26.0
CVE-2025-48943US	—	0.51% (43rd)	—	0.9.0	2025-05-30	0.8.0 → 0.9.0
CVE-2026-53923US	high7.5	0.48% (41st)	—	0.24.0	2026-06-22	2 versions

showing 50 of 98

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-400Uncontrolled Resource Consumption14 CVEs
CWE-770Allocation of Resources Without Limits or Throttling14 CVEs
CWE-502Deserialization of Untrusted Data11 CVEs
CWE-20Improper Input Validation10 CVEs
CWE-129Improper Validation of Array Index6 CVEs
CWE-617Reachable Assertion6 CVEs
CWE-1333Inefficient Regular Expression Complexity5 CVEs
CWE-248Uncaught Exception5 CVEs

sources (1)

Which sources assert this record, and when.

USOSV.dev96 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan