Vendor
NVIDIA
1,179 known vulnerabilities.
Products
33 results · Clear filters · Feed
-
Critical 10.0
NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue. This vu…
-
Critical 9.1
NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unau…
-
Critical 10.0
NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remot…
-
Critical 9.8
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of hard-coded cre…
-
Critical 9.9
NVIDIA OpenShell for Linux contains a vulnerability in its sandbox provisioning API, where an attacker could cause an i…
-
Critical 9.9
NVIDIA OpenShell for Linux contains a vulnerability where an attacker could cause a sandbox escape. A successful exploi…
-
Critical 9.8CVE-2026-47627 Public exploit
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause path traversal. A succe…
-
Critical 9.8
NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an o…
-
Critical 9.8
NVIDIA AIStore framework contains a vulnerability where an attacker could bypass authentication. A successful exploit o…
-
Critical 9.0
NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function…
-
Critical 9.0
NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function…
-
Critical 9.8
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A succe…
-
Critical 9.8
NVIDIA NVFlare Dashboard: Authorization bypass through user-controlled key via user management and authentication system
NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key. A successful exploit of this vulnerability may lead to privilege e…
-
Critical 9.0
NVIDIA APEX for Linux contains a vulnerability where an unauthorized attacker could cause a deserialization of untruste…
-
Critical 9.8
NVIDIA Isaac Launchable contains a vulnerability where an attacker could exploit a hard-coded credential issue. A succe…
-
Critical 9.8
NVIDIA Isaac Launchable contains a vulnerability where an attacker could cause an execution with unnecessary privileges…
-
Critical 9.8
NVIDIA Isaac Launchable contains a vulnerability where an attacker could cause an execution with unnecessary privileges…
-
Critical 9.0CVE-2025-33210 Public exploit
NVIDIA Isaac Lab contains a deserialization vulnerability. A successful exploit of this vulnerability might lead to cod…
-
Critical 9.3
NVIDIA DGX Spark GB10 contains a vulnerability in SROOT, where an attacker could use privileged access to gain access t…
-
Critical 9.8
NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker …
-
Critical 9.1
NVIDIA Triton Inference Server contains a vulnerability in the HTTP server, where an attacker could start a reverse she…
-
Critical 9.8
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a stack overflow through speciall…
-
Critical 9.8
NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause stack buffe…
-
Critical 9.0CVE-2025-23266 Public exploit
NVIDIA Container Toolkit for all platforms contains an Untrusted Search Path
NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker could execute arbitrary code with elevated permissions. A successful exploit of this vulnerability might lead to escalation o…
-
Critical 9.8
NVIDIA Base Command Manager contains a missing authentication vulnerability in the CMDaemon component. A successful exp…
-
Critical 9.0
NVIDIA Container Toolkit contains a Time-of-check Time-of-Use (TOCTOU) vulnerability
NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases wh…
-
Critical 9.0CVE-2024-0087 EPSS 20%
CVE
NVIDIA Triton Inference Server for Linux contains a vulnerability where a user can set the logging location to an arbitrary file. If this file exists, logs are appended to the file. A successful exploit of this vulnerability might lead to code execution, deni…
-
Critical 9.0
CVE
NVIDIA DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause stack memory corruption by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execu…
-
Critical 9.3
CVE
NVIDIA DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, d…
-
Critical 9.3
CVE
NVIDIA DGX A100 baseboard management controller (BMC) contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet. A successful exploit of this vulnerability may l…
-
Critical 9.8
NVFLARE unsafe deserialization due to Pickle
NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrit…
-
Critical 9.8
Unsafe yaml deserialization in NVFlare
NVFLARE, versions prior to 2.1.2, contains a vulnerability in its utils module, where YAML files are loaded via yaml.load() instead of yaml.safe_load(). The deserialization of Untrusted Data, may allow an unprivileged network attacker to cause Remote Code Exe…
-
Critical 9.8
Unsafe deserialisation in the PKI implementation scheme of NVFlare
NVFLARE, versions prior to 2.1.2, contains a vulnerability in its PKI implementation module, where The CA credentials are transported via pickle and no safe deserialization. The deserialization of Untrusted Data may allow an unprivileged network attacker to c…