137
CVEs
15
Critical
96
High
0
KEV
1
PoC
105
Unpatched C/H
7.3%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
15
HIGH
96
MEDIUM
25
LOW
0
Monthly CVE Trend
Affected Products (30)
Gpu Driver
127
Virtual Gpu
95
Gpu Display Driver
66
Triton Inference Server
58
Linux Kernel
53
Virtual Gpu Manager
47
Android
47
Jetson Linux
46
Cuda Toolkit
45
Windows
42
Cloud Gaming
37
Geforce Experience
34
Nemo Megatron Bridge
30
Nemo
25
Python
19
Dgx A100 Firmware
19
Tensorrt Llm
16
Dgx H100 Firmware
15
Dynamo
15
Debian Linux
15
Dgx Os
14
Megatron Bridge
13
Mac Os X
12
Geforce
12
Tesla
12
Rtx Quadro Nvs
12
Nemoclaw
12
Jetson Tx1
11
AI / ML
11
Shield Experience
11
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-65083 | Privilege escalation and remote code execution in NVIDIA OpenShell for Linux stem from an incomplete deny-list in its sandbox provisioning API, letting an authenticated attacker submit inputs that were meant to be blocked but were not. Because the flaw crosses the sandbox boundary (CVSS scope change), a successful exploit can yield code execution, privilege escalation, information disclosure, data tampering, and denial of service against the host. No public exploit identified at time of analysis, and the issue is not in CISA KEV. | CRITICAL | 9.9 | 0.5% | 50 |
No patch
|
| CVE-2026-65093 | Sandbox escape in NVIDIA OpenShell for Linux lets a low-privileged actor already operating inside the sandbox break its isolation boundary, potentially achieving code execution, privilege escalation, data tampering, and information disclosure on the host. The flaw is rooted in an uncontrolled search path element (CWE-427), so a resource the sandbox loads can be redirected to attacker-supplied code. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the assigned 9.9 CVSS reflects the full compromise achievable once the sandbox boundary is breached. | CRITICAL | 9.9 | 0.5% | 50 |
No patch
|
| CVE-2026-63298 | Canonical LXD's NVIDIA GPU passthrough configuration handler fails to sanitize newline characters in user-supplied `nvidia.driver.capabilities` and `nvidia.require.*` instance config values, enabling an authenticated attacker to inject arbitrary directives into the generated `lxc.conf` file. Any LXD user with instance-creation or configuration-modification privileges can exploit this to escape the container boundary and execute arbitrary commands on the host with the full privileges of the LXD daemon - effectively achieving complete host compromise. No public exploit code or CISA KEV listing exists at time of analysis, but the network-accessible, low-privilege attack path and scope-changed CVSS vector reflect an elevated real-world threat for shared or multi-tenant LXD deployments. | CRITICAL | 9.9 | 0.4% | 50 |
|
| CVE-2026-65098 | Weak authentication in NVIDIA NemoClaw for Linux (versions 0 through 0.0.4) lets remote attackers bypass the authentication enforced by its remote-access helper workflow, enabling code execution, information disclosure, and data tampering on the host. The flaw was self-reported by NVIDIA and carries a critical 9.8 CVSS rating with a fully unauthenticated network vector. No public exploit identified at time of analysis, and EPSS estimates only a 0.57% 30-day exploitation probability, so the raw severity outpaces observed real-world activity. | CRITICAL | 9.8 | 0.6% | 50 |
No patch
|
| CVE-2026-24254 | Out-of-bounds write in the multimodal serving topology of NVIDIA Dynamo for Linux allows remote unauthenticated attackers to corrupt memory, with a rated 9.8 CVSS potentially enabling remote code execution, privilege escalation, data tampering, information disclosure, and denial of service. NVIDIA (the reporting vendor) rates it critical with a network-reachable, no-privilege, no-interaction vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so the score reflects potential rather than observed impact. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-47627 | Path traversal in NVIDIA Triton Inference Server for Linux (CWE-22) lets remote attackers manipulate file paths to reach locations outside intended directories, with the vendor citing denial of service as the primary outcome. NVIDIA assigned a critical 9.8 CVSS score claiming full confidentiality, integrity, and availability impact, though the published description only asserts DoS. There is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-65084 | Improper certificate validation in NVIDIA NemoClaw for Linux (versions up to and including 0.0.1) allows network attackers to intercept or manipulate the deployment process, potentially yielding information disclosure, data tampering, remote code execution, and privilege escalation. The flaw stems from the deployment routine failing to properly verify TLS certificates (CWE-295), enabling machine-in-the-middle attacks. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the vendor rates full technical impact. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-65081 | Untrusted code execution in NVIDIA NemoClaw for Linux (versions up to and including 0.0.21) stems from the installer executing code without verifying its integrity, letting an attacker who can supply or interpose malicious code during installation achieve arbitrary code execution, privilege escalation, data tampering, information disclosure, and denial of service. NVIDIA assigns a CVSS of 9.8 with a fully network-based, no-privilege, no-interaction vector, though the flaw is rooted in the install process. There is no public exploit identified at time of analysis, EPSS is low at 0.25% (17th percentile), and CISA SSVC records no known exploitation. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-24270 | Authentication bypass in NVIDIA AIStore, a scalable distributed object-storage framework for AI/ML data pipelines, lets a remote attacker circumvent access controls (CWE-290) and reach protected functionality without valid credentials. Because the flaw yields full confidentiality, integrity, and availability impact (CVSS 9.8), successful exploitation can enable information disclosure of stored datasets, tampering with training data, privilege escalation, and denial of service. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. | CRITICAL | 9.8 | 0.8% | 49 |
No patch
|
| CVE-2026-55447 | Arbitrary file read leading to remote code execution affects Langflow versions prior to 1.9.2 in any flow that uses BaseFileComponent-derived nodes (Read File, Docling, Docling Serve, NVIDIA Retriever Extraction, Video File, Unstructured API). An attacker who can submit a TAR archive containing symlinks - for example through a RAG ingestion pipeline that accepts user documents - causes the server to follow those links and ingest arbitrary host files such as Langflow's JWT secret_key, which can then be used to forge admin tokens and execute Python via the Code Interpreter node. Publicly available exploit code exists (researcher-published PoC archive and demo video); not listed in CISA KEV. | CRITICAL | 9.6 | 0.3% | 48 |
|
| CVE-2026-53805 | Unauthenticated remote code execution in NVIDIA Spatial Intelligence Lab's GEN3C inference API server allows network attackers to execute arbitrary Python code by sending crafted pickle payloads to the /request-inference and /seed-model endpoints. The endpoints feed raw HTTP bodies directly into pickle.loads() with no authentication or validation, so a standard __reduce__ gadget yields code execution as the inference process. No public exploit identified at time of analysis, but the upstream patch and a VulnCheck advisory document the precise vulnerable code path. | CRITICAL | 9.3 | 0.7% | 47 |
|
| CVE-2026-62239 | Arbitrary file write via symlink attack in FlashAttention's build toolchain (through 2.8.3.post1) allows a local low-privileged attacker to redirect NVIDIA archive extraction to attacker-controlled paths by pre-planting a symlink in the predictable cache directory before a victim initiates a build. The hopper/setup.py download_and_copy() function called tarfile.extractall() without symlink validation or path confinement, meaning extracted NVIDIA toolchain binaries could be written anywhere accessible to the victim's process. No active exploitation is confirmed in CISA KEV, but a publicly available proof-of-concept exists at GitHub issue #2637 and a vendor patch is available in commit 0816ef1. | MEDIUM | 5.3 | 0.1% | 47 |
PoC
|
| CVE-2026-65091 | OS command injection in NVIDIA OpenShell across all supported platforms allows a network-accessible malicious gateway to execute arbitrary operating system commands on a victim host when a user interacts with that gateway. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) reflects that an attacker requires no privileges on the victim system but does require the victim to interact with a malicious or attacker-controlled gateway endpoint. Successful exploitation yields full code execution, data tampering, and information disclosure - with no public exploit or CISA KEV listing identified at time of analysis. | HIGH | 8.8 | 1.4% | 45 |
No patch
|
| CVE-2025-23350 | Out-of-bounds write in the command interface of NVIDIA ConnectX network adapters and BlueField DPUs allows a local user holding an assigned virtual function (VF) to corrupt device memory via crafted input, potentially achieving arbitrary code execution on the device itself. Because the flaw sits at the firmware command interface reachable from a SR-IOV guest, a successful exploit crosses the guest/device trust boundary (CVSS scope-changed, base 9.0) and can compromise the host that owns the adapter. This is a vendor-reported issue with no public exploit identified at time of analysis and no CISA KEV listing. | CRITICAL | 9.0 | 0.3% | 45 |
No patch
|
| CVE-2025-23351 | Out-of-bounds write in the command interface of NVIDIA ConnectX SmartNICs and BlueField DPUs allows a local user holding virtual function (VF) access - typically a tenant inside a guest VM - to corrupt device memory via crafted input and potentially achieve arbitrary code execution on the network device itself. Because the CVSS scope is Changed (S:C), a successful exploit crosses the VF isolation boundary and threatens the host and other tenants, making this a serious multi-tenant/cloud isolation-breakout risk. There is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.0 | 0.3% | 45 |
No patch
|