llama-index-packs-vanna (>=0.1.5, <=0.3.0), nvidia-nat-vanna (>=1.4.0a20260123, <=1.7.0a20260513) +1 more potentially affected by CVE-2026-4229 via vanna (2.0.2)

vanna PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on vanna and may be impacted: - llama-index-packs-vanna =0.1.5, =1.4.0a20260123, =1.0.0, =2.0.0 Source cves: CVE-2026-4229 Source advisory: OSV:PYSEC-2026-3397...

aiqtoolkit (>=1.1.0a20251020, <=1.5.0a20260122), aiqtoolkit-agno (>=1.3.0, <=1.3.1) +41 more potentially affected by CVE-2025-45691 via ragas (>=0.2.6, <=0.2.15)

ragas PYPI version =0.2.6, =1.1.0a20251020, =1.3.0, =1.1.0a20250506, =1.3.0, =1.1.0a20251020, =1.3.0, =1.3.0, =2.8.1, =1.0.0, =1.1.0a20251020, =1.4.0a20251206, =1.1.0a20251020, =1.1.0a20251020, =1.4.0a20260106, =1.5.0a20260211, =1.5.0a20260218 and more Source cves: CVE-2025-45691 Source advisory:...

PYSEC-2026-2673 NVIDIA NeMo Framework Deserializes Untrusted Data

NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering...

NVIDIA NeMo Framework contains a vulnerability where malicious data could cause remote code execution

NVIDIA NeMo Framework contains a vulnerability where malicious data could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering...

PYSEC-2026-2672 NVIDIA NeMo Framework contains a vulnerability where malicious data could cause remote code execution

NVIDIA NeMo Framework contains a vulnerability where malicious data could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering...

PT-2026-59320

NVIDIA NeMo Framework contains a vulnerability where malicious data could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering...

PT-2026-57903

Name of the Vulnerable Software and Affected Versions FlashAttention versions prior to 2.8.3.post1 Description A symlink attack exists in the download and copy function within hopper/setup.py. The issue occurs because NVIDIA toolchain archives are extracted without validating symlinks or filterin...

PT-2026-59323

NVIDIA NeMo Framework contains a vulnerability where an attacker may cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure and data tampering...

PT-2026-59322

NVIDIA NeMo Framework contains a vulnerability in checkpoint loading where an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure and data tampering...

PT-2026-59321

NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for NVIDIA for RHEL 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

nlm-ingestor (>=0.1.1, <=0.1.5), nvidia-modulus-sym (>=1.0.0, <=1.7.0) +1 more potentially affected by CVE-2026-49851 via mistune (2.0.3)

mistune PYPI version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - nlm-ingestor =0.1.1, =1.0.0, =1.7.0 - stattic 1.0.0 Source cves: CVE-2026-49851 Source advisory: OSV:GHSA-QCQ2-496W-V96P...

SUSE CVE-2026-24260

NVIDIA Container Toolkit for Linux contains a vulnerability where an attacker could cause a time-of-check time-of-use race condition. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, and data tampering...

nlm-ingestor (>=0.1.1, <=0.1.5), nvidia-modulus-sym (>=1.0.0, <=1.7.0) +1 more potentially affected by CVE-2026-59924 via mistune (2.0.3)

mistune PYPI version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - nlm-ingestor =0.1.1, =1.0.0, =1.7.0 - stattic 1.0.0 Source cves: CVE-2026-59924 Source advisory: OSV:PYSEC-2026-2212...

nlm-ingestor (>=0.1.1, <=0.1.5), nvidia-modulus-sym (>=1.0.0, <=1.7.0) +1 more potentially affected by CVE-2026-59927 via mistune (2.0.3)

mistune PYPI version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - nlm-ingestor =0.1.1, =1.0.0, =1.7.0 - stattic 1.0.0 Source cves: CVE-2026-59927 Source advisory: OSV:PYSEC-2026-2215...

nlm-ingestor (>=0.1.1, <=0.1.5), nvidia-modulus-sym (>=1.0.0, <=1.7.0) +1 more potentially affected by CVE-2026-59930 via mistune (2.0.3)

mistune PYPI version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - nlm-ingestor =0.1.1, =1.0.0, =1.7.0 - stattic 1.0.0 Source cves: CVE-2026-59930 Source advisory: OSV:PYSEC-2026-2218...

nlm-ingestor (>=0.1.1, <=0.1.5), nvidia-modulus-sym (>=1.0.0, <=1.7.0) +1 more potentially affected by CVE-2026-59925 via mistune (2.0.3)

mistune PYPI version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - nlm-ingestor =0.1.1, =1.0.0, =1.7.0 - stattic 1.0.0 Source cves: CVE-2026-59925 Source advisory: OSV:PYSEC-2026-2213...

nlm-ingestor (>=0.1.1, <=0.1.5), nvidia-modulus-sym (>=1.0.0, <=1.7.0) +1 more potentially affected by CVE-2026-59929 via mistune (2.0.3)

mistune PYPI version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - nlm-ingestor =0.1.1, =1.0.0, =1.7.0 - stattic 1.0.0 Source cves: CVE-2026-59929 Source advisory: OSV:PYSEC-2026-2217...

nlm-ingestor (>=0.1.1, <=0.1.5), nvidia-modulus-sym (>=1.0.0, <=1.7.0) +1 more potentially affected by CVE-2026-59926 via mistune (2.0.3)

mistune PYPI version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - nlm-ingestor =0.1.1, =1.0.0, =1.7.0 - stattic 1.0.0 Source cves: CVE-2026-59926 Source advisory: OSV:PYSEC-2026-2214...

nlm-ingestor (>=0.1.1, <=0.1.5), nvidia-modulus-sym (>=1.0.0, <=1.7.0) +1 more potentially affected by CVE-2026-59923 via mistune (2.0.3)

mistune PYPI version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - nlm-ingestor =0.1.1, =1.0.0, =1.7.0 - stattic 1.0.0 Source cves: CVE-2026-59923 Source advisory: OSV:PYSEC-2026-2211...