View Ridge Security
Back to Cyber Hose

vLLM RCE via LlavaOnevision2 processor (CVE-2026-90553)

A CVSS 8.5 remote code execution flaw in vLLM headlines this run, alongside two denial-of-service CVEs in the same project.

🔓 CVEs & KEV

  • CVE-2026-90553 — vllm-project vLLM — CVSS 8.5 — vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processorvLLM be...

  • CVE-2026-90555 — CVSS 7.1 — vLLM before 0.28.0 Denial of Service via Audio HeadervLLM versions before 0.2...

  • CVE-2026-90554 — CVSS 6.9 — vLLM before 0.28.0 Denial of Service via audio extractionvLLM versions >=0.10...

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check