NVIDIA vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-65151 NVIDIA NeMo Agent Toolkit contains vulnerability where an attacker could cause a SQL injection issue.High 8.4 · Oct 27, 2026
• CVE-2026-65145 NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue.Critical 10 · Oct 27, 2026
• CVE-2026-65120 NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery.High 7.1 · Oct 27, 2026
• CVE-2026-65119 NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an attacker could cause inclusion of functionality High 8.4 · Oct 27, 2026
• CVE-2026-47486 NVIDIA PhysX for all platforms contains a vulnerability where an attacker could cause an out-of-bounds write.High 7.8 · Oct 27, 2026
• CVE-2026-24269 NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery.High 7.1 · Oct 27, 2026
• CVE-2026-65180 NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file.High 7.8 · Oct 13, 2026
• CVE-2026-65173 NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote attacker may submit crCritical 9.1 · Oct 13, 2026
• CVE-2026-65172 NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may acHigh 8.6 · Oct 13, 2026
• CVE-2026-65170 NVIDIA AIStore for Linux contains a vulnerability in the experimental HT backend where an unauthenticated remote attacker may cause server-side request forgery High 8.6 · Oct 13, 2026
• CVE-2026-65164 NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remote attacker may cause an improper limitatHigh 8.1 · Oct 13, 2026
• CVE-2026-65162 NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supply Kubernetes host-namCritical 10 · Oct 13, 2026
• CVE-2026-65161 NVIDIA AIStore for Linux contains a vulnerability in the Promote API where an unauthenticated remote attacker may read files accessible to the target process byHigh 7.5 · Oct 13, 2026
• CVE-2026-65150 NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read.High 7.3 · Oct 13, 2026
• CVE-2026-65149 NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds write.High 7.3 · Oct 13, 2026
• CVE-2026-65148 NVIDIA DALI contains a vulnerability where an attacker could cause a stack-based buffer overflow.High 7.3 · Oct 13, 2026
• CVE-2026-65147 NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read.High 7.3 · Oct 13, 2026
• CVE-2026-65141 NVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval injection.High 7.8 · Oct 13, 2026
• CVE-2026-65110 NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an RCE by convincing a user to load a maliciously crafted file.High 7.8 · Oct 13, 2026
• CVE-2026-65104 NVIDIA Megatron-LM for all platforms contains a vulnerability in inference, where an attacker could cause hash collisions in the cache used for inference requesHigh 7.1 · Oct 13, 2026
• CVE-2026-65103 NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-side object rename handler, where an unauthenticated remote attacker could cause High 8.1 · Oct 13, 2026
• CVE-2026-65101 NVIDIA AIStore for Linux contains a vulnerability in the distributed sort component where an attacker could cause server-side request forgery by supplying a craHigh 8.6 · Oct 13, 2026
• CVE-2026-65142 NVIDIA Model-Optimizer contains a vulnerability where an attacker may cause deserialization of untrusted data.High 7.8 · Oct 6, 2026
• CVE-2026-47602 NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user can cause the driver to dereference an untHigh 7.1 · Sep 30, 2026
• CVE-2026-47601 NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the open-source kernel module DMA-BUF import path where an unprivileged local user cHigh 7.8 · Sep 30, 2026