Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-47627exploit | 9.8 critical | 1.0% | nvidia, triton_inference_server | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause path traversal. A successful exploit might lead to denial of service. | Thu 22 Oct |
| CVE-2026-53805exploit | 9.3 critical | 1.0% | no CPE yet | NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote code execution vulnerability in the inference API server where the /request-inference and /seed-model endpoints deserialize raw HTTP request bodies using Python's pickle.loads() without authentication or input validation. Attackers can supply a crafted payload containing a __reduce__ gadget to the inference API port to achieve remote code execution as the inference process. | Mon 26 Oct |
| CVE-2026-47630exploit | 5.5 medium | 0.00% | nvidia, triton_inference_server | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution. | Thu 22 Oct |
| CVE-2026-65145 | 10.0 critical | 1.0% | no CPE yet | NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue. This vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure. | Tue 27 Oct |
| CVE-2026-65162 | 10.0 critical | 1.0% | no CPE yet | NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supply Kubernetes host-namespace and container-security settings. A successful exploit may lead to code execution, privilege escalation, information disclosure, data tampering, and denial of service. | 13 Oct |
| CVE-2026-41512 | 9.9 critical | 1.0% | mozilla, 0din_scanner | ai-scanner is an AI model safety scanner built on NVIDIA garak. From version 1.0.0 to before version 1.4.1, there is a remote code execution vulnerability via JavaScript injection in `BrowserAutomation::PlaywrightService`. This issue has been patched in version 1.4.1. | Mon 26 Oct |
| CVE-2026-63298 | 9.9 critical | 1.0% | canonical, lxd | An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execute arbitrary code on the host system with the privileges of the LXD daemon. | Sat 24 Oct |
| CVE-2026-24178 | 9.8 critical | 1.0% | nvidia, nvflare | NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key. A successful exploit of this vulnerability may lead to privilege escalation, data tampering, information disclosure, code execution, and denial of service. | Mon 26 Oct |
| CVE-2026-24270 | 9.8 critical | 1.0% | no CPE yet | NVIDIA AIStore framework contains a vulnerability where an attacker could bypass authentication. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, and data tampering. | Sun 25 Oct |
| CVE-2026-24227 | 9.8 critical | 1.0% | nvidia, tensorrt | NVIDIA TensorRT for contains a vulnerability where a user might cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution. | Sat 24 Oct |
| CVE-2026-24254 | 9.8 critical | 1.0% | nvidia, dynamo | NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure. | Sat 24 Oct |
| CVE-2025-33222 | 9.8 critical | 1.0% | nvidia, isaac_launchable | NVIDIA Isaac Launchable contains a vulnerability where an attacker could exploit a hard-coded credential issue. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, and data tampering. | 19 Oct |
| CVE-2025-33223 | 9.8 critical | 1.0% | nvidia, isaac_launchable | NVIDIA Isaac Launchable contains a vulnerability where an attacker could cause an execution with unnecessary privileges. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure and data tampering. | 19 Oct |
| CVE-2025-33224 | 9.8 critical | 1.0% | nvidia, isaac_launchable | NVIDIA Isaac Launchable contains a vulnerability where an attacker could cause an execution with unnecessary privileges. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure and data tampering. | 19 Oct |
| CVE-2026-55447 | 9.6 critical | 1.0% | langflow | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, by controlling a files that are digested into the RAG, an attacker can direct the node to read any file on the file-system by absolute path. All components based on BaseFileComponent are vulnerable to the vulnerability. This includes Docling (DoclingInlineComponent), Docling Serve, DoclingRemoteComponent), Read File (FileComponent), NVIDIA Retriever Extraction (NvidiaIngestComponent), Video File (VideoFileComponent), and Unstructured API (UnstructuredComponent). This vulnerability is fixed in 1.9.2. | Sun 25 Oct |
| CVE-2026-47606 | 9.1 critical | 1.0% | nvidia, triton_inference_server | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution and information disclosure. | Thu 22 Oct |
| CVE-2026-65173 | 9.1 critical | 1.0% | no CPE yet | NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote attacker may submit crafted token-revocation lists. A successful exploit may lead to data tampering and denial of service. | 13 Oct |
| CVE-2025-33213 | 8.8 high | 1.0% | no CPE yet | NVIDIA Merlin Transformers4Rec for Linux contains a vulnerability in the Trainer component, where a user could cause a deserialization issue. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering. | 8 Oct |
| CVE-2025-33214 | 8.8 high | 1.0% | no CPE yet | NVIDIA NVTabular for Linux contains a vulnerability in the Workflow component, where a user could cause a deserialization issue. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering. | 8 Oct |
| CVE-2026-24253 | 8.2 high | 1.0% | nvidia, dynamo | NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service and data tampering. | Sat 24 Oct |
| CVE-2026-47623 | 8.2 high | 1.0% | nvidia, dynamo | NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to denial of service and data tampering. | Sat 24 Oct |
| CVE-2026-47619 | 8.1 high | 1.0% | nvidia, dynamo | NVIDIA Dynamo for Linux examples and recipes contain a vulnerability where an attacker could cause a system failure. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure. | Sat 24 Oct |
| CVE-2026-65103 | 8.1 high | 1.0% | no CPE yet | NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-side object rename handler, where an unauthenticated remote attacker could cause an improper limitation of a pathname to a restricted directory by submitting a crafted rename destination directly to an AIStore target, resulting in the arbitrary creation or overwrite of a file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, data tampering, and denial of service. | 13 Oct |
| CVE-2026-65164 | 8.1 high | 1.0% | no CPE yet | NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remote attacker may cause an improper limitation of a pathname to a restricted directory by supplying crafted archive member names to a dSort job. A successful exploit may lead to arbitrary file creation or overwrite, code execution, information disclosure, data tampering, and denial of service. | 13 Oct |
| CVE-2026-24252 | 7.8 high | 1.0% | nvidia, nemo | NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A successful exploit of this vulnerability may lead to code execution, data tampering, escalation of privileges and information disclosure. | Sat 24 Oct |
| CVE-2026-24146 | 7.5 high | 1.0% | nvidia, triton_inference_server | NVIDIA Triton Inference Server contains a vulnerability where insufficient input validation and a large number of outputs could cause a server crash. A successful exploit of this vulnerability might lead to denial of service. | Mon 26 Oct |
| CVE-2026-24173 | 7.5 high | 1.0% | nvidia, triton_inference_server | NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request to the server. A successful exploit of this vulnerability might lead to denial of service. | Mon 26 Oct |
| CVE-2026-24174 | 7.5 high | 1.0% | nvidia, triton_inference_server | NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request to the server. A successful exploit of this vulnerability might lead to denial of service. | Mon 26 Oct |
| CVE-2026-24264 | 7.5 high | 1.0% | nvidia, triton_inference_server | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause improper handling of highly compressed data. A successful exploit of this vulnerability might lead to denial of service. | Sun 25 Oct |
| CVE-2026-24266 | 7.5 high | 1.0% | nvidia, triton_inference_server | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a use-after-free issue. A successful exploit of this vulnerability might lead to denial of service. | Sun 25 Oct |
| CVE-2026-47476 | 7.5 high | 1.0% | nvidia, triton_inference_server | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause uncontrolled resource consumption. A successful exploit of this vulnerability might lead to denial of service. | Sat 24 Oct |
| CVE-2026-47477 | 7.5 high | 1.0% | no CPE yet | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a stack-based buffer overflow. A successful exploit of this vulnerability might lead to denial of service. | Sat 24 Oct |
| CVE-2026-47478 | 7.5 high | 1.0% | no CPE yet | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause the use of an expired file descriptor. A successful exploit of this vulnerability might lead to denial of service. | Sat 24 Oct |
| CVE-2026-24255 | 7.5 high | 1.0% | nvidia, dynamo | NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash collision by submitting images that share an identical pixel byte sequence but have different dimensions. A successful exploit of this vulnerability might lead to data tampering. | Sat 24 Oct |
| CVE-2026-47612 | 7.5 high | 1.0% | nvidia, dynamo | NVIDIA Dynamo for Linux contains a vulnerability in the image loading component where an attacker may cause improper limitation of a pathname to a restricted directory. A successful exploit of this vulnerability might lead to information disclosure. | Sat 24 Oct |
| CVE-2026-47613 | 7.5 high | 1.0% | nvidia, dynamo | NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause improper limitation of a pathname to a restricted directory by supplying a crafted local path in a multimodal request. A successful exploit of this vulnerability might lead to information disclosure. | Sat 24 Oct |
| CVE-2026-47614 | 7.5 high | 1.0% | nvidia, dynamo | NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure. | Sat 24 Oct |
| CVE-2026-47615 | 7.5 high | 1.0% | nvidia, dynamo | NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request forgery by supplying a crafted URL in a multimodal request. A successful exploit of this vulnerability might lead to information disclosure. | Sat 24 Oct |
| CVE-2026-47616 | 7.5 high | 1.0% | nvidia, dynamo | NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker may cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure. | Sat 24 Oct |
| CVE-2026-47617 | 7.5 high | 1.0% | nvidia, dynamo | NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker may cause server-side request forgery via DNS rebinding. A successful exploit of this vulnerability might lead to information disclosure. | Sat 24 Oct |
| CVE-2026-47618 | 7.5 high | 1.0% | nvidia, dynamo | NVIDIA Dynamo for Linux contains a vulnerability in the Rust multimodal media fetcher where an attacker could cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure. | Sat 24 Oct |
| CVE-2026-47628 | 7.5 high | 1.0% | nvidia, triton_inference_server | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an allocation of resources without limits. A successful exploit might lead to denial of service. | Thu 22 Oct |
| CVE-2026-47629 | 7.5 high | 1.0% | nvidia, triton_inference_server | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause improper input validation. A successful exploit might lead to denial of service. | Thu 22 Oct |
| CVE-2025-33201 | 7.5 high | 1.0% | nvidia, triton_inference_server | NVIDIA Triton Inference Server contains a vulnerability where an attacker may cause an improper check for unusual or exceptional conditions issue by sending extra large payloads. A successful exploit of this vulnerability may lead to denial of service. | 18 Oct |
| CVE-2025-33211 | 7.5 high | 1.0% | nvidia, triton_inference_server | NVIDIA Triton Server for Linux contains a vulnerability where an attacker may cause an improper validation of specified quantity in input. A successful exploit of this vulnerability may lead to denial of service. | 18 Oct |
| CVE-2026-65161 | 7.5 high | 1.0% | no CPE yet | NVIDIA AIStore for Linux contains a vulnerability in the Promote API where an unauthenticated remote attacker may read files accessible to the target process by supplying a crafted absolute source path. A successful exploit may lead to information disclosure. | 13 Oct |
| CVE-2024-56719 | 5.5 medium | 1.0% | linux, linux_kernel | In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO DMA API usage causing oops Commit 66600fac7a98 ("net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data") moved the assignment of tx_skbuff_dma[]'s members to be later in stmmac_tso_xmit(). The buf (dma cookie) and len stored in this structure are passed to dma_unmap_single() by stmmac_tx_clean(). The DMA API requires that the dma cookie passed to dma_unmap_single() is the same as the value returned from dma_map_single(). However, by moving the assignment later, this is not the case when priv->dma_cap.addr64 > 32 as "des" is offset by proto_hdr_len. This causes problems such as: dwc-eth-dwmac 2490000.ethernet eth0: Tx DMA map failed and with DMA_API_DEBUG enabled: DMA-API: dwc-eth-dwmac 2490000.ethernet: device driver tries to +free DMA memory it has not allocated [device address=0x000000ffffcf65c0] [size=66 bytes] Fix this by maintaining "des" as the original DMA cookie, and use tso_des to pass the offset DMA cookie to stmmac_tso_allocator(). Full details of the crashes can be found at: https://lore.kernel.org/all/[email protected]/ https://lore.kernel.org/all/klkzp5yn5kq5efgtrow6wbvnc46bcqfxs65nz3qy77ujr5turc@bwwhelz2l4dw/ | 15 Oct |
| CVE-2025-33185 | 5.3 medium | 1.0% | no CPE yet | NVIDIA AIStore contains a vulnerability in AuthN where an unauthenticated user may cause information disclosure. A successful exploit of this vulnerability may lead to information disclosure. | 18 Oct |
| CVE-2026-24186 | 8.8 high | 0.00% | nvidia, nvflare | NVIDIA FLARE SDK contains a vulnerability in FOBS, where an attacker may cause deserialization of untrusted data by sending a malicious FOBS- encoded message. A successful exploit of this vulnerability might lead to code execution. | Mon 26 Oct |
| CVE-2025-33186 | 8.8 high | 0.00% | no CPE yet | NVIDIA AIStore contains a vulnerability in AuthN. A successful exploit of this vulnerability might lead to escalation of privileges, information disclosure, and data tampering. | 18 Oct |
50 of 160 · Next
Download these 160 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.