CVE-2025-23361

NVIDIA NeMo Framework for all platforms contains a vulnerability in a script, where malicious input created by an attacker may cause improper control of code generation. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and da...

Use of Hard-coded Credentials

Overview Affected versions of this package are vulnerable to Use of Hard-coded Credentials in the AuthN implementation. An attacker can gain unauthorized access to sensitive information, escalate privileges, and tamper with data by leveraging hard-coded credentials. Remediation Upgrade...

CVE-2025-33186

NVIDIA AIStore contains a vulnerability in the AuthN component that could allow privilege escalation, information disclosure, and data tampering (CVSSv3.1 base score 8.8, Network attack, No authentication required, user interaction required). Affected: NVIDIA AIStore AuthN across versions prior t...

CVE-2025-33186

NVIDIA AIStore contains a vulnerability in AuthN. A successful exploit of this vulnerability might lead to escalation of privileges, information disclosure, and data tampering...

CVE-2025-33186

NVIDIA AIStore contains a vulnerability in AuthN. A successful exploit of this vulnerability might lead to escalation of privileges, information disclosure, and data tampering...

CVE-2025-33178

NVIDIA NeMo Framework for all platforms contains a vulnerability in the bert services component where malicious data created by an attacker may cause a code injection. A successful exploit of this vulnerability may lead to Code execution, Escalation of privileges, Information disclosure, and Data...

CVE-2025-33178

NVIDIA NeMo Framework for all platforms contains a vulnerability in the bert services component where malicious data created by an attacker may cause a code injection. A successful exploit of this vulnerability may lead to Code execution, Escalation of privileges, Information disclosure, and Data...

CVE-2025-33178

CVE-2025-33178 affects NVIDIA NeMo Framework ( Bert services component). The vulnerability arises from processing of malicious data, enabling code injection which may lead to Code execution, Privilege Escalation, Information disclosure, and Data tampering. NVIDIA’s advisories indicate remediation...

CVE-2025-33178

NVIDIA NeMo Framework for all platforms contains a vulnerability in the bert services component where malicious data created by an attacker may cause a code injection. A successful exploit of this vulnerability may lead to Code execution, Escalation of privileges, Information disclosure, and Data...

CVE-2025-23361

NVIDIA NeMo Framework for all platforms contains a vulnerability in a script, where malicious input created by an attacker may cause improper control of code generation. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and da...

CVE-2025-23361

NVIDIA NeMo Framework for all platforms contains a vulnerability in a script, where malicious input created by an attacker may cause improper control of code generation. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and da...

CVE-2025-23361

NVIDIA NeMo Framework for all platforms contains a vulnerability in a script, where malicious input created by an attacker may cause improper control of code generation. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and da...

CVE-2025-23361

CVE-2025-23361 affects NVIDIA NeMo Framework. A vulnerability in a script allows malicious input to control code generation, with potential code execution, privilege escalation, information disclosure, and data tampering. Affected product: NVIDIA NeMo Framework (version context shows 2.0.3 in one...

CVE-2025-23357

CVE-2025-23357 affects NVIDIA Megatron-LM across all platforms. The vulnerability resides in a vulnerable script that can process malicious data, enabling a code injection that may lead to code execution, privilege escalation, information disclosure, and data tampering. Documented sources indicat...

CVE-2025-23357

NVIDIA Megatron-LM for all platforms contains a vulnerability in a script, where malicious data created by an attacker may cause a code injection issue. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, data tampering...

CVE-2025-23357

NVIDIA Megatron-LM for all platforms contains a vulnerability in a script, where malicious data created by an attacker may cause a code injection issue. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, data tampering...

MAL-2025-113492 Malicious code in drunk_python_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df4761ab8d6c68c11764980faf6d162db1f2beffe0f1349db9d764a0ed12e4e6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-118518 Malicious code in zul-rangginang80-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 297ac0a4099ee97d9fd0f150b192a1cffad7e52db3d7427fc01bdfb85879a757 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rival_skink_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43b0c7c98f6f76c54d63268783986523acc068213a85522a81a75af804c54f66 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hurt_wallaby-appteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59b95cb2436256624efe377a48b49b19eaa9684a06bece6045bf44693b0842c8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...