https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 03:58:00 +0000 https://cve.radiocsirt.org/vuln/cve-2026-47155 <p><strong>Affected:</strong> vllm-project vllm</p> <p>vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, vLLM&#39;s revision pinning controls do not consistently apply to all artifacts loaded for a model. A deployment that supplies --revision or --code-revision can still load dynamic code, GGUF files, image processors, retrieval side weights, or same-repository subfolder weights/config from an unpinned/default revision. This is a supply-chain integrity issue for pinned vLLM deployments. Operators can believe they are serving a reviewed model revision while vLLM resolves behavior-affecting nested or sibling artifacts outside that reviewed revision. This vulnerability is fixed in 0.22.0.</p> <p><strong>Affected:</strong> vllm-project vllm</p> <p>vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, vLLM&#39;s revision pinning controls do not consistently apply to all artifacts loaded for a model. A deployment that supplies --revision or --code-revision can still load dynamic code, GGUF files, image processors, retrieval side weights, or same-repository subfolder weights/config from an unpinned/default revision. This is a supply-chain integrity issue for pinned vLLM deployments. Operators can believe they are serving a reviewed model revision while vLLM resolves behavior-affecting nested or sibling artifacts outside that reviewed revision. This vulnerability is fixed in 0.22.0.</p> https://cve.radiocsirt.org/vuln/cve-2026-47155