CVE-2026-47471: Heap-based Buffer Overflow

NVIDIA TensorRT-LLM for any platform contains a vulnerability in tensor deserialization, where an attacker could cause a heap based buffer overflow. A successful exploit of this vulnerability might lead to information disclosure, data tampering, or denial of service...

CVE-2026-24229: Missing Authentication for Critical Function

NVIDIA TensorRT-LLM for Linux contains a vulnerability in the disaggregated orchestrator component, where an attacker could read, write, or delete internal cluster state by sending requests to the FastAPI server. A successful exploit of this vulnerability might lead to information disclosure, dat...

CVE-2026-24226: Inclusion of Functionality from Untrusted Control Sphere

NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause improper control of code generation. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

CVE-2026-47470: Improper Input Validation

NVIDIA TensorRT-LLM for any platform contains a vulnerability in the gRPC server chat API endpoint, where an attacker could cause CWE-20 by local attack. A successful exploit of this vulnerability might lead to denial of service...

CVE-2026-47478: Use of Expired File Descriptor

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause the use of an expired file descriptor. A successful exploit of this vulnerability might lead to denial of service...

CVE-2026-47479: Uncontrolled Resource Consumption

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause uncontrolled resource consumption. A successful exploit of this vulnerability might lead to denial of service...

PT-2026-58760

Name of the Vulnerable Software and Affected Versions NVIDIA Triton Inference Server for Linux affected versions not specified Description An issue exists where an attacker can cause the use of an expired file descriptor. This flaw is network exploitable and requires no authentication, which may...

PT-2026-58758

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause uncontrolled resource consumption. A successful exploit of this vulnerability might lead to denial of service...

CVE-2026-47482: Missing Release of Memory after Effective Lifetime

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause missing release of memory after effective lifetime. A successful exploit of this vulnerability might lead to denial of service...

CVE-2026-47472: Deserialization of Untrusted Data

NVIDIA TensorRT-LLM contains a vulnerability in its inter-process communication layer where an attacker with local same-user access could cause deserialization. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service...

CVE-2026-47477: Stack-based Buffer Overflow

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a stack-based buffer overflow. A successful exploit of this vulnerability might lead to denial of service...

CVE-2026-47480: Uncaught Exception

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an uncaught exception. A successful exploit of this vulnerability might lead to denial of service...

CVE-2026-47481: Authentication Bypass Using an Alternate Path or Channel

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an authentication bypass through an alternative path or channel. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data...

CVE-2026-62239

FlashAttention through 2.8.3.post1, fixed in commit 0816ef1, contains a symlink attack vulnerability in the downloadandcopy function within hopper/setup.py that extracts NVIDIA toolchain archives without validating symlinks or filtering tar members. A local attacker can pre-plant a symlink in the...

aiqtoolkit-agno (>=1.1.0a20250429, <=1.3.1), nvidia-nat-agno (>=1.1.0a20251020, <=1.5.0a20260122) potentially affected by CVE-2026-10105 via agno (1.2.16)

agno PYPI version 1.2.16 is affected by a known vulnerability. The following packages have a transitive dependency on agno and may be impacted: - aiqtoolkit-agno =1.1.0a20250429, =1.1.0a20251020, =1.5.0a20260122 Source cves: CVE-2026-10105 Source advisory: OSV:PYSEC-2026-2333...

ng-model-gym (>=0.3.0, <=0.4.0), nvidia-vipe (>=0.1.1, <=1.2.0) +1 more potentially affected by CVE-2026-34543 via openexr (>=3.2.4, <=3.4.4)

openexr PYPI version =3.2.4, =0.3.0, =0.1.1, =1.2.0 - sfx 0.1.0 Source cves: CVE-2026-34543 Source advisory: OSV:PYSEC-2026-2850...

ng-model-gym (>=0.3.0, <=0.4.0), nvidia-vipe (>=0.1.1, <=1.2.0) +1 more potentially affected by CVE-2026-34544 via openexr (>=3.2.4, <=3.4.4)

openexr PYPI version =3.2.4, =0.3.0, =0.1.1, =1.2.0 - sfx 0.1.0 Source cves: CVE-2026-34544 Source advisory: OSV:PYSEC-2026-2847...

PYSEC-2026-2674 NVIDIA NeMo Framework contains an RCE vulnerability in checkpoint loading

NVIDIA NeMo Framework contains a vulnerability in checkpoint loading where an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure and data tampering...

NVIDIA NeMo Framework contains a vulnerability leading to Remote Code Execution

NVIDIA NeMo Framework contains a vulnerability where an attacker may cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure and data tampering...

PYSEC-2026-2675 NVIDIA NeMo Framework contains a vulnerability leading to Remote Code Execution

NVIDIA NeMo Framework contains a vulnerability where an attacker may cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure and data tampering...