PT-2026-67803

Name of the Vulnerable Software and Affected Versions NVIDIA Dynamo for Linux affected versions not specified Description An issue exists where an attacker could trigger a race condition during the initialization of the LoRA manager singleton. A race condition occurs when the timing or order of...

CVE-2026-24254: Authentication Bypass Using an Alternate Path or Channel

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosu...

CVE-2026-47620: Concurrent Execution using Shared Resource with Improper Synchronization

NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initialization. A successful exploit of this vulnerability might lead to data tampering and denial of service...

CVE-2026-47623: Deserialization of Untrusted Data

NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to denial of service and data tampering...

CVE-2026-47621: Time-of-check Time-of-use (TOCTOU) Race Condition

NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initialization. A successful exploit of this vulnerability might lead to denial of service and data tampering...

CVE-2026-47619: Reliance on Insufficiently Trustworthy Component

NVIDIA Dynamo for Linux examples and recipes contain a vulnerability where an attacker could cause a system failure. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure...

PT-2026-67790

Name of the Vulnerable Software and Affected Versions NVIDIA Dynamo for Linux affected versions not specified Description An issue exists that allows an attacker to trigger an out-of-bounds write, which occurs when data is written outside the intended memory boundary. This could result in data...

PT-2026-67805

Name of the Vulnerable Software and Affected Versions NVIDIA Dynamo for Linux affected versions not specified Description An issue exists where an attacker could cause deserialization of untrusted data. Deserialization is the process of converting a data format, such as JSON or XML, back into an...

PT-2026-67801

Name of the Vulnerable Software and Affected Versions NVIDIA Dynamo for Linux affected versions not specified Description Examples and recipes within the software contain a flaw that allows an attacker to cause a system failure. This could result in code execution, data tampering, denial of...

PT-2026-67802

Name of the Vulnerable Software and Affected Versions NVIDIA Dynamo for Linux affected versions not specified Description An issue exists where an attacker could trigger a race condition during the initialization of the LoRA manager singleton. A race condition occurs when the timing or order of...

CVE-2026-24255: Incomplete Comparison with Missing Factors

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash collision by submitting images that share an identical pixel byte sequence but have different dimensions. A successful exploit of this vulnerability might lead to data tamperin...

PT-2026-67792

Name of the Vulnerable Software and Affected Versions NVIDIA Dynamo for Linux affected versions not specified Description A flaw exists in the multimodal embedding cache. An attacker can trigger a hash collision by submitting images that possess an identical pixel byte sequence despite having...

Security Bulletin: NVIDIA Dynamo - August 2026

NVIDIA has released a software update for NVIDIA® Dynamo. To protect your system, clone or update this software from the NVIDIA ai-dynamo/dynamo GitHub repo. Go to NVIDIA Product Security. Details The following table summarizes the potential vulnerabilities that this security update addresses and...

Sequelize: SQL Injection (Oracle DB)

Summary SQL Injection is possible with strings only if dialect is set to oracle. The vulnerability was confirmed on Sequelize v6.37.3. Details The escape function defined in sql-string.js does not escape quotes if the value starts with TOTIMESTAMP or TODATE. javascript else if dialect === 'oracle...

GHSA-V8FG-2RW7-Q452 Sequelize: SQL Injection (Oracle DB)

Summary SQL Injection is possible with strings only if dialect is set to oracle. The vulnerability was confirmed on Sequelize v6.37.3. Details The escape function defined in sql-string.js does not escape quotes if the value starts with TOTIMESTAMP or TODATE. javascript else if dialect === 'oracle...

Linux Distros Unpatched Vulnerability : CVE-2026-12259

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing...

PT-2026-66417

Name of the Vulnerable Software and Affected Versions MELSEC MX Controller MX-R model affected versions not specified MELSEC MX Controller MX-F model affected versions not specified Master/local module affected versions not specified CC-Link IE TSN interface board affected versions not specified...

Mitsubishi Electric CC-Link IE TSN Communication Protocol (Update A)

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker with access to the same network segment to tamper with communication data in the affected product by sending specially crafted packets under specific timing conditions. This could allow the attacker to cause a...

CVE-2026-14224

The Easy Appointments WordPress plugin versions prior to 3.12.28 is vulnerable to an IDOR (Insecure Direct Object Reference) flaw. The plugin fails to verify that the appointment targeted by its customer-data update action belongs to the authenticated user, relying instead on a shared nonce that ...

CVE-2026-24252

NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A successful exploit of this vulnerability may lead to code execution, data tampering, escalation of privileges and information disclosure...