Threat database

NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, or information disclosure.

NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit of this vulnerability might lead to escalation of privileges, denial of service, or information disclosure.

NVIDIA NemoClaw has a server-side request forgery (SSRF) vulnerability in the validateEndpointUrl() component. An attacker can supply a crafted endpoint URL referencing the 0.0.0.0/8 address range via a blueprint configuration file or CLI flag to trigger the SSRF. Exploiting this vulnerability may lead to information disclosure. The issue affects all versions prior to v0.0.13. There is currently no official patch or remediation guidance available from the vendor.

NVIDIA NeMoClaw has a vulnerability in its sandbox environment initialization component that allows a remote attacker to cause improper access control. By sending prompt-injected content, the attacker can cause the agent to read and exfiltrate host environment variables that are not properly restricted during sandbox creation. This vulnerability can lead to the disclosure of sensitive system information. It affects all versions prior to v0.0.18. The vulnerability has a high severity with a CVSS score of 8.6. There is no confirmed patch or official remediation available at this time.

NVIDIA FLARE SDK prior to version 2.7.2 contains an improper input validation vulnerability involving path traversal. Exploiting this flaw could allow an attacker with limited privileges to cause information disclosure. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. No official patch or remediation guidance has been provided yet by NVIDIA. There are no known exploits in the wild at this time.

NVIDIA FLARE SDK versions prior to 2.7.2 contain a deserialization vulnerability in the FOBS component. An attacker can send a malicious FOBS-encoded message that triggers deserialization of untrusted data, potentially leading to remote code execution. This vulnerability has a high severity score of 8.8. No official patch or remediation guidance has been provided yet by NVIDIA. There are no known exploits in the wild at this time.

NVIDIA FLARE SDK versions prior to 2.7.2 contain a critical vulnerability (CVE-2026-24178) in the NVFlare Dashboard's user management and authentication system. This flaw allows an unauthenticated attacker to bypass authorization by manipulating a user-controlled key. Exploitation can lead to privilege escalation, data tampering, information disclosure, code execution, and denial of service. The vulnerability has a CVSS score of 9.8, indicating critical severity. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

NVIDIA CUDA-Q contains a vulnerability in an endpoint, where an unauthenticated attacker could cause an out-of-bounds read by sending a maliciously crafted request. A successful exploit of this vulnerability might lead to denial of service and information disclosure.

NVIDIA KAI Scheduler contains a vulnerability where an attacker could access API endpoints without authorization. A successful exploit of this vulnerability might lead to information disclosure.

NVIDIA KAI Scheduler contains a vulnerability where an attacker could cause improper authorization through cross-namespace pod references. A successful exploit of this vulnerability might lead to data tampering.

CVE-2026-24175 is a high-severity vulnerability in NVIDIA Triton Inference Server affecting all versions prior to r26.02. It involves an uncaught exception triggered by sending a malformed request header, which can cause the server to crash and result in denial of service. There is no confirmed patch or official remediation available at this time. No known exploits in the wild have been reported.

NVIDIA Triton Inference Server has a vulnerability (CVE-2026-24174) involving incorrect conversion between numeric types that can be triggered by sending a malformed request. Exploiting this flaw can cause the server to crash, resulting in a denial of service condition. This affects all versions prior to r26.02. The vulnerability has a high severity rating with a CVSS score of 7.5. There is no confirmed patch or official remediation available at this time.

NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request to the server. A successful exploit of this vulnerability might lead to denial of service.

NVIDIA Triton Inference Server contains a vulnerability in triton server where an attacker may cause an information disclosure by uploading a model configuration. A successful exploit of this vulnerability may lead to information disclosure or denial of service.

NVIDIA Triton Inference Server contains a vulnerability where insufficient input validation and a large number of outputs could cause a server crash. A successful exploit of this vulnerability might lead to denial of service.

NVIDIA DALI contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to arbitrary code execution.

NVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.

NVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.

NVIDIA Jetson Linux has vulnerability in initrd, where an unprivileged attacker with physical access coul inject incorrect command line arguments. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, data tampering, and information disclosure.

NVIDIA Jetson Linux has a vulnerability in initrd, where the nvluks trusted application is not disabled. A successful exploit of this vulnerability might lead to information disclosure.