{"metadata": {"vulnerability": "CVE-2026-90553", "count": 21, "kinds": {"milestone": 5, "sighting": 6, "kev": 0, "other": 10}, "linked_omitted": 1}, "data": [{"timestamp": "2026-08-28T00:00:00Z", "date_only": false, "value": "2026-08-28T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-90553", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-12T11:13:43.326Z", "date_only": false, "value": "2026-09-12T11:13:43.326Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-90553", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-12T12:08:56.821Z", "date_only": false, "value": "2026-09-12T12:08:56.821Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-90553", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-12T12:08:56.821Z", "date_only": false, "value": "2026-09-12T12:08:56.821Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-90553", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-12T13:16:53Z", "date_only": false, "value": "2026-09-12T13:16:53Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-RP86-QF3F-PQFC", "record": "GHSA-RP86-QF3F-PQFC", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-09-12T13:16:53.887Z", "date_only": false, "value": "2026-09-12T13:16:53.887", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-90553", "record": "FKIE_CVE-2026-90553", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-09-12T13:16:53.887Z", "date_only": false, "value": "2026-09-12T13:16:53.887Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2026-3985", "record": "PYSEC-2026-3985", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-09-12T13:59:58.194Z", "date_only": false, "value": "2026-09-12T13:59:58.194921Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvdaiumtdh2z", "record": "CVE-2026-90553", "field": "creation_timestamp", "uuid": "9cae77c9-4452-4e8d-ac6f-bf21b590c0d9", "content": "\ud83d\udfe0 CVE-2026-90553 - High (7.8)\n\nvLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processo...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-90553/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvdaiumtdh2z"}, {"timestamp": "2026-09-12T15:31:50Z", "date_only": false, "value": "2026-09-12T15:31:50Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-RP86-QF3F-PQFC", "record": "GHSA-RP86-QF3F-PQFC", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-09-12T15:31:50Z", "date_only": false, "value": "2026-09-12T15:31:50Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-RP86-QF3F-PQFC", "record": "GHSA-RP86-QF3F-PQFC", "field": "modified", "linked_record": true}, {"timestamp": "2026-09-14T18:25:25.303Z", "date_only": false, "value": "2026-09-14T18:25:25.303206Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-90553", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-14T18:25:25.303Z", "date_only": false, "value": "2026-09-14T18:25:25.303206Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-90553", "record": "FKIE_CVE-2026-90553", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-09-14T18:25:36.665Z", "date_only": false, "value": "2026-09-14T18:25:36.665Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-90553", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-14T18:25:36.665Z", "date_only": false, "value": "2026-09-14T18:25:36.665Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-90553", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-16T07:26:28.826Z", "date_only": false, "value": "2026-09-16T07:26:28.826977Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvmmey7k4i22", "record": "CVE-2026-90553", "field": "creation_timestamp", "uuid": "cf750f75-149f-4a9f-a344-bc859732a610", "content": "vLLM CVE-2026-90553 (CVSS 8.5) allows RCE via LlavaOnevision2 loader; update to vLLM 0.28.0 now and sandbox model loading. https://cti.securitycyber.uk", "url": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvmmey7k4i22"}, {"timestamp": "2026-09-16T07:26:40.286Z", "date_only": false, "value": "2026-09-16T07:26:40.286282Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvmmfcqqud2g", "record": "CVE-2026-90553", "field": "creation_timestamp", "uuid": "547bf1cf-3441-4d9e-a10a-59749260f34d", "content": "vLLM CVE-2026-90553 (CVSS 8.5) allows RCE via the LlavaOnevision2 processor when trust_remote_code is ignored \u2014 update to v0.28.0. https://cti.securitycyber.uk", "url": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvmmfcqqud2g"}, {"timestamp": "2026-09-16T07:27:00.072Z", "date_only": false, "value": "2026-09-16T07:27:00.072089Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvmmfvwrx42i", "record": "CVE-2026-90553", "field": "creation_timestamp", "uuid": "d2cc6e00-4177-43bc-bde1-c5b4bc983119", "content": "vLLM CVE-2026-90553 (RCE) lets a malicious model run code in the vLLM process; patch to vLLM 0.28.0 now or disable remote processors: https://cti.securitycyber.uk", "url": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvmmfvwrx42i"}, {"timestamp": "2026-09-16T07:27:14.552Z", "date_only": false, "value": "2026-09-16T07:27:14.552388Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvmmgdoup424", "record": "CVE-2026-90553", "field": "creation_timestamp", "uuid": "306d4a3b-9a3e-4f6c-92f5-48618a66e5a7", "content": "CVE-2026-90553 vLLM (<0.28.0) allows malicious models to execute code despite trust_remote_code \u2014 upgrade to v0.28.0 now (CVSS 8.5). https://cti.securitycyber.uk", "url": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvmmgdoup424"}, {"timestamp": "2026-09-16T17:31:40.200Z", "date_only": false, "value": "2026-09-16T17:31:40.200", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-90553", "record": "FKIE_CVE-2026-90553", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-09-17T08:35:58.695Z", "date_only": false, "value": "2026-09-17T08:35:58.695483Z", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2026-3985", "record": "PYSEC-2026-3985", "field": "modified", "linked_record": true}, {"timestamp": "2026-09-17T23:07:07.434Z", "date_only": false, "value": "2026-09-17T23:07:07.434238Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mvqrfvggyl2u", "record": "CVE-2026-90553", "field": "creation_timestamp", "uuid": "1c6b5a2f-1a5f-4295-909e-ce82920a9f4a", "content": "\ud83d\udccc CVE-2026-90553 - vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter... https://www.cyberhub.blog/cves/CVE-2026-90553", "url": "https://bsky.app/profile/cyberhub.blog/post/3mvqrfvggyl2u"}], "metrics": {"as_of": "2026-11-14T03:53:46.527Z", "anchors": {"origin": {"timestamp": "2026-08-28T00:00:00Z", "date_only": false, "value": "2026-08-28T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-90553", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-08-28T00:00:00Z", "date_only": false, "value": "2026-08-28T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-90553", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 6753226.527735, "hours": 1875.8962577041666, "days": 78.16234407100694, "min_seconds": 6666826.527735, "max_seconds": 6753226.527735, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-28T00:00:00Z", "date_only": false, "value": "2026-08-28T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-90553", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-14T03:53:46.527Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}