NVIDIA NemoClaw for Linux has a vulnerability in its installation scripts that allows downloading code without verifying its integrity. Exploiting this flaw could enable attackers to execute arbitrary code, escalate privileges, disclose information, and tamper with data. The vulnerability is identified as CWE-494 and has a CVSS 3.1 score of 7.5, indicating high severity. No specific affected versions or patches are currently documented.
NVIDIA NemoClaw for Linux has an OS command injection vulnerability in its Telegram bridge component. This flaw could allow an attacker with limited privileges to execute arbitrary OS commands, potentially leading to code execution, privilege escalation, information disclosure, and data tampering. The vulnerability is tracked as CVE-2026-65096 and has a high severity rating with a CVSS score of 7.8. No patch or official remediation guidance has been provided yet. There are no known exploits in the wild at this time.
NVIDIA OpenShell for Linux has a critical vulnerability (CVE-2026-65093) involving an uncontrolled search path element (CWE-427). This flaw could allow an attacker to escape a sandbox environment, potentially leading to code execution, privilege escalation, data tampering, and information disclosure. The vulnerability has a high CVSS score of 9.9, indicating severe impact. No specific affected versions or patches are currently documented. There are no known exploits in the wild at this time.
CVE-2026-65092 is a path traversal vulnerability in NVIDIA OpenShell Sandbox for Linux. It allows an attacker with limited privileges to bypass L7 REST network policy restrictions by manipulating pathnames. Successful exploitation can lead to information disclosure and data tampering. The vulnerability has a high severity score of 8.5 and does not currently have an official patch or remediation guidance from the vendor.
CVE-2026-65091 is a high-severity OS command injection vulnerability in NVIDIA OpenShell affecting all platforms. A malicious gateway could exploit this flaw to execute arbitrary OS commands, potentially leading to code execution, data tampering, and information disclosure. There is no confirmed patch or official remediation available at this time.
NVIDIA Unified Fabric Manager Enterprise - GA contains a vulnerability due to the use of a hard-coded cryptographic key in its session management component. This flaw could allow an attacker with local access and high attack complexity to extract sensitive information, potentially leading to information disclosure and privilege escalation. The vulnerability has a medium severity rating with a CVSS score of 5.1. No affected versions or patches have been explicitly stated.
NVIDIA Unified Fabric Manager Enterprise - GA contains a command injection vulnerability in the IBDiagnet API. An authenticated attacker with administrative privileges can exploit this flaw by sending crafted API requests. Successful exploitation may result in code execution, privilege escalation, and information disclosure. The vulnerability has a CVSS 3.1 base score of 6.8, indicating a medium severity level. No affected versions or patch information are provided in the available data.
NVIDIA Unified Fabric Manager Enterprise - GA contains a command injection vulnerability in its user management component. An authenticated administrator can exploit this by sending a crafted API request, potentially leading to code execution, privilege escalation, and information disclosure. The vulnerability has a CVSS score of 6.8, indicating a medium severity level. No affected versions or patches are explicitly stated in the available data.
NVIDIA Unified Fabric Manager Enterprise - GA contains a command injection vulnerability in its plugin management API. An authenticated user with low privileges can send a specially crafted API request to inject code. Successful exploitation could lead to code execution, privilege escalation, and information disclosure. The vulnerability has a high severity score of 8. No patch or official remediation has been confirmed yet.
NVIDIA Unified Fabric Manager Enterprise - GA has a vulnerability in its web interface authorization component that allows an authenticated user to bypass proper authentication by sending specially crafted HTTP requests. Exploiting this flaw could lead to code execution and privilege escalation. The vulnerability is identified as CWE-287 (Improper Authentication) and has a high severity CVSS score of 8.8. No patch or official remediation has been confirmed yet.
NVIDIA DGX Spark has a vulnerability in its UEFI firmware that allows a privileged local user to bypass administrator password protection. This issue is classified as a CWE-693 Protection Mechanism Failure. Exploiting this vulnerability could lead to unauthorized changes in the system's UEFI settings without needing the administrator password.
NVIDIA DGX Spark contains a vulnerability in its standalone MM firmware that allows an out-of-bounds read. Exploitation of this flaw could lead to information disclosure. The vulnerability has a medium severity rating with a CVSS score of 6. No specific affected versions or patches have been provided.
NVIDIA DGX Spark system firmware contains a NULL pointer dereference vulnerability (CWE-476) that could be exploited by a privileged attacker. Exploitation may result in code execution, privilege escalation, denial of service, information disclosure, and data tampering. The vulnerability has a high severity CVSS score of 8.2. No patch or remediation information is currently available from the vendor.
NVIDIA DGX Spark system firmware contains an out-of-bounds write vulnerability (CWE-787) that can be exploited by a privileged attacker. Successful exploitation may result in code execution, privilege escalation, denial of service, information disclosure, and data tampering. The vulnerability has a high CVSS score of 8.2, indicating significant impact potential. No specific affected versions or patches have been disclosed yet.
NVIDIA DGX Spark system firmware contains a high-severity out-of-bounds write vulnerability (CWE-787) that could be exploited by a privileged attacker. Successful exploitation may result in code execution, privilege escalation, denial of service, information disclosure, and data tampering. The vulnerability has a CVSS 3.1 base score of 8.2, indicating significant impact. No patch or official remediation guidance has been provided yet. There are no known exploits in the wild at this time.
CVE-2026-47630 is an absolute path traversal vulnerability in NVIDIA Triton Inference Server for Linux. An attacker with limited privileges could exploit this flaw to cause absolute path traversal, potentially leading to code execution. The vulnerability has a medium severity rating with a CVSS score of 5.5. There is no indication of known exploits in the wild or an official patch available at this time.
CVE-2026-47629 is a high-severity vulnerability in NVIDIA Triton Inference Server for Linux, caused by improper input validation. Exploitation could lead to denial of service conditions. No confidentiality or integrity impacts are reported. The affected version is 0.0-26.05. There is no information on available patches or vendor advisories.
CVE-2026-47628 is a high-severity vulnerability in NVIDIA Triton Inference Server for Linux version 0.0-26.05. It involves allocation of resources without limits or throttling, which could allow an attacker to cause a denial of service condition. No confidentiality or integrity impacts are reported. No known exploits are currently in the wild.
CVE-2026-47627 is a critical path traversal vulnerability in NVIDIA Triton Inference Server for Linux version 0.0-26.05. This flaw allows an attacker to improperly limit pathname access, potentially leading to denial of service. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution and information disclosure.