SieveLLM 보안 모니터

모니터

오늘 볼 것
추세
검색

내 환경

내 스택
자산 감시
설정·연결

정보

소개·판정 규칙
RSS
llms.txt

jk 이동 / 검색

Sieve내 스택에 해당하는 LLM 보안 이슈만검색 /

검색

데이터: OSV.dev(GitHub Advisory 포함) · CISA KEV. 판정은 버전 범위 비교로만 하고, 원문 링크를 항상 함께 둡니다.

모니터

오늘 볼 것
추세
검색

내 환경

내 스택
자산 감시
설정·연결

정보

소개·판정 규칙
RSS
llms.txt

“vllm” 검색 · Sieve

최근 14일

AI·LLM 관련 항목

전체61

치명·높음33

악성 패키지2

실제 악용0

자주 나온 패키지

최근 28일

mcp-atlassianPyPI25
vllmPyPI23
open-webuiPyPI18
litellmPyPI

수집 상태

OSV 30분 · KEV 6시간 주기

CISA KEV2026. 10. 27.
OSV · crates.io2026. 10. 27.
OSV · Go2026. 10. 27.
OSV · npm2026. 10. 27.
OSV · PyPI2026. 10. 27.

30건 · AI 관련·실제 악용·최신 순

높음취약점

vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)

PyPI vllm · 0.31.0에서 수정 · GHSA-gx7p-2j49-hfq4 · 2026. 10. 24.

13

pydantic-aiPyPI9

중간취약점

vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine

PyPI vllm · 0.31.0에서 수정 · GHSA-p92p-rxj5-7p2x · 2026. 10. 24.

등급 없음취약점

A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty

PyPI vllm · 0.32.0에서 수정 · PYSEC-2026-4319 · 2026. 10. 18.

중간취약점

vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

PyPI vllm · 0.30.0에서 수정 · GHSA-ph72-cqr5-qpp7 · 2026. 10. 15.

중간취약점

vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion

PyPI vllm · 0.30.0에서 수정 · GHSA-58v5-2m8f-94pr · 2026. 10. 15.

중간취약점

vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service

PyPI vllm · 0.30.0에서 수정 · GHSA-2823-qmq8-rwvj · 2026. 10. 15.

낮음취약점

vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

PyPI vllm · 0.30.0에서 수정 · GHSA-935w-9g4m-p28p · 2026. 10. 15.

중간취약점

vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach

PyPI vllm · 0.30.0에서 수정 · GHSA-x6mc-67gf-chw4 · 2026. 10. 15.

중간취약점

vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)

PyPI vllm · 0.30.0에서 수정 · GHSA-85xf-c7hm-whqw · 2026. 10. 8.

중간취약점

vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

PyPI vllm · 0.28.0에서 수정 · GHSA-ph3r-5jfg-f84f · 2026. 10. 8.

중간취약점

vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`

PyPI vllm · 0.30.0에서 수정 · GHSA-2phq-3phc-84px · 2026. 10. 8.

등급 없음취약점

A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a man

PyPI vllm · 0.27.0에서 수정 · PYSEC-2026-4186 · 2026. 10. 7.

중간취약점

vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions

PyPI vllm · 0.24.0에서 수정 · GHSA-hcwq-8wjf-3gcr · 2026. 10. 2.

중간취약점

vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation

PyPI vllm · 0.28.0에서 수정 · GHSA-8pw2-6jv3-mj5j · 2026. 10. 2.

등급 없음취약점

vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can sen

PyPI vllm · 0.30.0에서 수정 · PYSEC-2026-4007 · 2026. 9. 30.

등급 없음취약점

vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion request

PyPI vllm · 0.30.0에서 수정 · PYSEC-2026-4005 · 2026. 9. 30.

등급 없음취약점

vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomple

PyPI vllm · 0.30.0에서 수정 · PYSEC-2026-4004 · 2026. 9. 30.

등급 없음취약점

vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbit

PyPI vllm · 0.30.0에서 수정 · PYSEC-2026-4008 · 2026. 9. 30.

등급 없음취약점

vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configured with TieringOffloadingSpec and a peer-to-peer secondary tier. Attackers can s

PyPI vllm · 0.30.0에서 수정 · PYSEC-2026-4006 · 2026. 9. 30.

등급 없음취약점

vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams._validate_allowed_token_ids(). Attackers can supply token IDs above the o

PyPI vllm · 0.29.0에서 수정 · PYSEC-2026-3998 · 2026. 9. 29.

등급 없음취약점

vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs index the penalty prompt-presence bitset without bounds checking against vocabulary

PyPI vllm · 0.30.0에서 수정 · PYSEC-2026-3999 · 2026. 9. 29.

등급 없음취약점

vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). Attackers can supply out-of-bounds token i

PyPI vllm · 0.30.0에서 수정 · PYSEC-2026-4000 · 2026. 9. 29.

등급 없음취약점

vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can submit requests with max_tokens=0

PyPI vllm · 0.30.0에서 수정 · PYSEC-2026-3996 · 2026. 9. 29.

높음취약점

vLLM introduced enhanced protection for CVE-2025-62164

PyPI vllm · 0.13.0에서 수정 · GHSA-mcmc-2m55-j8jj · 2026. 9. 12.

중간취약점

vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds

PyPI vllm · 0.26.0에서 수정 · GHSA-8737-qx52-hjff · 2026. 9. 10.

중간취약점

vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages

PyPI vllm · 0.26.0에서 수정 · GHSA-hwrm-c4cx-rf4j · 2026. 9. 10.

중간취약점

vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts

PyPI vllm · 0.26.0에서 수정 · GHSA-pr7f-p5mw-fc87 · 2026. 9. 10.

중간취약점

vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m

PyPI vllm · 0.26.0에서 수정 · GHSA-48jh-3gj7-fg8v · 2026. 9. 10.

중간취약점

vLLM: Cross-User Data Leak Vulnerability

PyPI vllm · 0.27.0에서 수정 · GHSA-7m6h-x95x-82q5 · 2026. 9. 10.

중간취약점

vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections

PyPI vllm · 0.26.0에서 수정 · GHSA-4hhp-h66f-j5j7 · 2026. 9. 10.