Security2 hOctober 12, 2026, 05:39

vLLM 0.30 and older: 30+ new advisories, most without CVE IDs, scanners miss them

Between 12 September and 9 October 2026, vLLM published more than 30 security advisories, most without CVE IDs, so pip-audit and Dependabot report nothing. The flaws are fixed in vLLM 0.31.0, released 5 October 2026.

DEV Community

Open source

30+ vLLM advisories from 12 September to 9 October 2026, most with no CVE ID
GHSA-h3rc-6mm3-gc2m (CVSS 8.1): unauthenticated /tokenize when trust_remote_code=True
GHSA-gx7p-2j49-hfq4 (CVSS 7.5): per-request mm_processor_kwargs exhaust CPU or GPU
vLLM 0.31.0, released 5 October 2026, fixes all listed issues

#VLLM

AMD squeezes lightweight FSR 4 onto handhelds, older devices may miss out

Software

Audit: License Scanners Miss OSMF Fees in .NET Packages

Security

SecFoo: AI security scanner invented vulnerabilities without seeing code

Security

vLLM 0.30 and older: 30+ new advisories, most without CVE IDs, scanners miss them

AMD squeezes lightweight FSR 4 onto handhelds, older devices may miss out

Audit: License Scanners Miss OSMF Fees in .NET Packages

SecFoo: AI security scanner invented vulnerabilities without seeing code

World open-sources ProveKit to verify people without collecting IDs