NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A successful exploit of this vulnerability may lead to code execution, data tampering, escalation of privileges and information disclosure.
NVIDIA Transformers4Rec contains a deserialization vulnerability (CWE-502) that allows improper handling of untrusted data. Exploitation could lead to denial of service but does not impact confidentiality or integrity. The vulnerability has a medium severity score of 4.3 and currently no known exploits or patches are reported.
NVIDIA TensorRT contains a heap-based buffer overflow vulnerability (CWE-122) that could be exploited by an attacker to execute arbitrary code. The vulnerability has a high severity with a CVSS score of 7.8. No affected versions or patch information are currently provided. The vulnerability requires local access with low complexity and user interaction. No known exploits are reported in the wild at this time.
NVIDIA TensorRT contains a heap-based buffer overflow vulnerability (CWE-122) that could be exploited by an attacker to execute arbitrary code. The vulnerability has a high severity with a CVSS score of 7.8. No specific affected versions or patches have been disclosed yet. The vulnerability requires local access with low complexity and user interaction. Exploitation could lead to full confidentiality, integrity, and availability impact.
NVIDIA TensorRT contains a vulnerability involving improper validation of an array index. This flaw could potentially allow an attacker to execute arbitrary code. The vulnerability is classified under CWE-129 and has a high severity rating with a CVSS score of 7.8. No specific affected versions or patches have been provided yet. There are no known exploits in the wild at this time.
NVIDIA TensorRT contains a deserialization vulnerability (CWE-502) that could allow an attacker to cause deserialization of untrusted data. Exploiting this vulnerability might lead to code execution. The vulnerability has a medium severity with a CVSS score of 5.3. No specific affected versions or patches are currently identified.
NVIDIA TensorRT-LLM has a vulnerability in its OpenAI-compatible inference API that allows an attacker to cause allocation of GPU resources without any limits or throttling. This can lead to denial of service conditions. The vulnerability is identified as CWE-770 and has a CVSS score of 6.2, indicating medium severity. No official patch or remediation guidance has been provided yet.
CVE-2026-47475 is a medium severity vulnerability in NVIDIA TensorRT-LLM's OpenAI-compatible inference API. It involves a reachable assertion in the sampler thread that an attacker could trigger. Successful exploitation may cause a denial of service condition. No patch or official remediation guidance is currently provided by the vendor. The affected version is 0.0. No known exploits are reported in the wild.
NVIDIA TensorRT-LLM contains an improper input validation vulnerability in its gRPC server chat API endpoint. This flaw can be exploited locally to cause a denial of service condition. The vulnerability is identified as CWE-20 and affects version 0.0 of the product. No official patch or remediation guidance has been provided yet. The issue has a medium severity rating with a CVSS score of 6.2.
NVIDIA TensorRT-LLM for Linux has a vulnerability (CVE-2026-24226) involving improper control of code generation due to inclusion of functionality from an untrusted control sphere. Exploitation could lead to code execution, data tampering, and information disclosure. The vulnerability has a medium severity with a CVSS score of 6.3. No patch or official remediation guidance is currently available.
NVIDIA TensorRT-LLM for Linux has a vulnerability identified as CVE-2026-24259 involving missing authentication for a critical function. This flaw could allow an attacker with high privileges to execute code, tamper with data, and disclose information without user interaction. The vulnerability has a medium severity rating with a CVSS score of 6.4. No official patch or remediation guidance is currently available from the vendor. The affected version is 0.0. There are no known exploits in the wild at this time.
NVIDIA TensorRT-LLM contains a deserialization vulnerability in its visual gen server component. This vulnerability arises from unsafe deserialization of unauthorized zeroMQ data, potentially allowing an attacker to execute arbitrary code. The issue affects version 0.0 of TensorRT-LLM. The CVSS score is 6.4, indicating a medium severity level.
NVIDIA TensorRT-LLM for Linux contains a server-side request forgery (SSRF) vulnerability in its multimodal media fetching functions. This flaw allows a network-accessible attacker to induce the server to make unintended requests. Successful exploitation may result in denial of service and information disclosure. The vulnerability is identified as CVE-2026-24234 with a CVSS score of 6.8, indicating medium severity. No official patch or remediation guidance has been provided yet. The affected version is 0.0. There are no known exploits in the wild at this time.
NVIDIA TensorRT-LLM for Linux contains a vulnerability in its disaggregated orchestrator component. This flaw allows an attacker to read, write, or delete internal cluster state by sending requests to the FastAPI server without authentication. Exploiting this vulnerability could lead to information disclosure, data tampering, and denial of service. The vulnerability is identified as CWE-306 (Missing Authentication for Critical Function). The CVSS v3.1 base score is 7.3, indicating a high severity level. No patch or official remediation has been confirmed yet.
NVIDIA TensorRT-LLM contains a write-what-where vulnerability (CWE-123) that could allow an attacker to perform arbitrary memory writes. Exploitation may result in data tampering, denial of service, and information disclosure. The vulnerability has a high severity score of 7.4. No official patch or remediation guidance is currently available from the vendor.
NVIDIA TensorRT-LLM contains a heap-based buffer overflow vulnerability in its tensor deserialization functionality. Exploitation of this flaw could allow an attacker to cause information disclosure, data tampering, or denial of service. The vulnerability is identified as CVE-2026-47471 and has a high severity rating with a CVSS score of 7.5. No official patch or remediation guidance is currently available from the vendor.
NVIDIA TensorRT-LLM has a deserialization vulnerability in its inter-process communication layer that can be exploited by a local attacker with the same user privileges. Successful exploitation could result in code execution, information disclosure, data tampering, and denial of service. The vulnerability is identified as CWE-502 and carries a high severity rating with a CVSS score of 7.8. No patch or official remediation guidance is currently available.
NVIDIA TensorRT-LLM for Linux has a deserialization vulnerability in its restricted unpickler used for model weight deserialization. This flaw allows a local, unauthenticated attacker to deserialize untrusted data, potentially leading to code execution, privilege escalation, data tampering, and information disclosure. The vulnerability is identified as CVE-2026-24233 with a high severity rating and a CVSS score of 8.4. No official patch or remediation guidance has been provided yet by the vendor.
NVIDIA Triton Inference Server for Linux has a vulnerability involving missing release of memory after its effective lifetime, which can lead to denial of service. This issue is identified as CWE-401 and affects version 0.0. The vulnerability has a high severity with a CVSS score of 7.5. No patch or official remediation has been confirmed yet.
NVIDIA Triton Inference Server for Linux has a vulnerability (CWE-288) that allows an attacker to bypass authentication using an alternate path or channel. Exploiting this flaw could lead to limited confidentiality and integrity impacts, including potential code execution, privilege escalation, information disclosure, and data tampering. The vulnerability has a CVSS score of 6.5 (medium severity). No patch or official remediation is currently confirmed.