Vulnerability Reportvllm/vllm-openai:nightly-aarch64

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker could exploit exposed vulnerabilities such as CVE-2026-42010 (authentication bypass) or CVE-2022-48434 (remote code execution) if the image is used as an internet-facing service. Removing unused multimedia packages (e.g., ffmpeg) would eliminate several high-severity findings. Note that CVE-2022-48434 requires specific hardware re-initialization conditions, reducing its practical exploitability in many environments. While a large number of post-exploit vulnerabilities exist, their low severity means they are less likely to be exploited in isolation.