Read the docs

NVIDIA

Records1248All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical86CVSS 9.0–10.0
CVSS high785CVSS 7.0–8.9

Exploited now

NVIDIA records in CISA KEV

No NVIDIA vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Records

34 records in Nemo · all components

TI-2025-17080 CVE-2025-23304 · GHSA-2ggj-xvxm-ww8m

Path traversal in NVIDIA NeMo Framework

Priority MEDIUM 45

NVIDIA NeMo library for all platforms contains a vulnerability in the model loading component, where an attacker could cause code injection by loading .nemo files with maliciously crafted metadata.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01157 Published 2025-08-13 Fixed in 2.3.2 CWE-22
Priority MEDIUM 44

NVIDIA NeMo Framework contains a vulnerability in checkpoint loading where an attacker could cause remote code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00665 Published 2026-03-24 Fixed in 2.6.2 CWE-502
Priority MEDIUM 44

NVIDIA NeMo Framework for all platforms contains a vulnerability where a user could cause a deserialization of untrusted data by remote code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00622 Published 2025-08-13 Fixed in 2.3.2 CWE-502
TI-2025-17027 CVE-2025-23251 · GHSA-4vvf-q5vq-fm6w

Code injection in NVIDIA NeMo Framework

Priority MEDIUM 44

NVIDIA NeMo Framework contains a vulnerability where a user could cause an improper control of generation of code by remote code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.007 Published 2025-04-22 Fixed in 25.02 CWE-94
TI-2025-17026 CVE-2025-23250 · GHSA-gxj5-h4j6-fmfx

Path traversal in NVIDIA NeMo Framework

Priority MEDIUM 44

NVIDIA NeMo Framework contains a vulnerability where an attacker could cause an improper limitation of a pathname to a restricted directory by an arbitrary file write.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00636 Published 2025-04-22 Fixed in 25.02 CWE-22
Priority MEDIUM 44

NVIDIA NeMo Framework contains a vulnerability where a user could cause a deserialization of untrusted data by remote code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00694 Published 2025-04-22 Fixed in 25.02 CWE-502
Priority MEDIUM 44

NVIDIA NeMo framework for Ubuntu contains a vulnerability in tools/asr_webapp where an attacker may cause an allocation of resources without limits or throttling.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00611 Published 2024-04-05 No fix listed CWE-770
TI-2025-17135 CVE-2025-23360 · GHSA-3mw5-7hq7-6p5w

Path traversal in NVIDIA NeMo Framework

Priority MEDIUM 43

NVIDIA Nemo Framework contains a vulnerability where a user could cause a relative path traversal issue by arbitrary file write.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00515 Published 2025-03-11 Fixed in 24.12 CWE-23
Priority MEDIUM 41

NVIDIA NeMo Framework contains a vulnerability where malicious data could cause remote code execution.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00639 Published 2026-02-18 Fixed in 2.6.1 CWE-502
Priority LOW 39

NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.01489 Published 2026-07-27 No fix listed CWE-78
TI-2025-24180 CVE-2025-33246 · GHSA-25w3-5rm9-v4wm

Command injection in NVIDIA NeMo Framework

Priority LOW 38

NVIDIA NeMo Framework for all platforms contains a vulnerability in the ASR Evaluator utility, where a user could cause a command injection by supplying crafted input to a configuration parameter.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.01067 Published 2026-02-18 Fixed in 2.6.1 CWE-77
TI-2025-24185 CVE-2025-33251 · GHSA-qq2v-q6qr-p5vx

Code injection in NVIDIA NeMo Framework

Priority LOW 36

NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00254 Published 2026-02-18 Fixed in 2.6.1 CWE-94
TI-2025-24184 CVE-2025-33250 · GHSA-wvvh-pcq5-hc6f

Code injection in NVIDIA NeMo Framework

Priority LOW 36

NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00254 Published 2026-02-18 Fixed in 2.6.1 CWE-94
Priority LOW 36

NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution in distributed environments.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00255 Published 2026-02-18 Fixed in 2.6.1 CWE-502
Priority LOW 36

NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution by loading a maliciously crafted file.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00255 Published 2026-02-18 Fixed in 2.6.1 CWE-502
TI-2025-24115 CVE-2025-33178 · GHSA-w8mh-76jq-xrg5

Code injection in NVIDIA NeMo Framework

Priority LOW 36

NVIDIA NeMo Framework for all platforms contains a vulnerability in the bert services component where malicious data created by an attacker may cause a code injection.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00281 Published 2025-11-11 Fixed in 2.5.0 CWE-94
TI-2025-17136 CVE-2025-23361 · GHSA-fwvg-jr4j-p326

Code injection in NVIDIA NeMo Framework

Priority LOW 36

NVIDIA NeMo Framework for all platforms contains a vulnerability in a script, where malicious input created by an attacker may cause improper control of code generation.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00258 Published 2025-11-11 Fixed in 2.5.0 CWE-94
TI-2025-17091 CVE-2025-23315 · GHSA-vqg6-gvc9-fh2h

Code injection in NVIDIA NeMo Framework

Priority LOW 36

NVIDIA NeMo Framework for all platforms contains a vulnerability in the export and deploy component, where malicious data created by an attacker could cause a code injection issue.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00256 Published 2025-08-26 Fixed in 2.4.0 CWE-94
TI-2025-17090 CVE-2025-23314 · GHSA-jjgw-82ph-6fgv

Code injection in NVIDIA NeMo Framework

Priority LOW 36

NVIDIA NeMo Framework for all platforms contains a vulnerability in the NLP component, where malicious data created by an attacker could cause a code injection issue.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00256 Published 2025-08-26 Fixed in 2.4.0 CWE-94
TI-2025-17089 CVE-2025-23313 · GHSA-gjmf-2qm5-q5m2

Code injection in NVIDIA NeMo Framework

Priority LOW 36

NVIDIA NeMo Framework for all platforms contains a vulnerability in the NLP component, where malicious data created by an attacker could cause a code injection issue.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00261 Published 2025-08-26 Fixed in 2.4.0 CWE-94
TI-2025-17088 CVE-2025-23312 · GHSA-94wm-455p-gr2f

Code injection in NVIDIA NeMo Framework

Priority LOW 36

NVIDIA NeMo Framework for all platforms contains a vulnerability in the retrieval services component, where malicious data created by an attacker could cause a code injection.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00256 Published 2025-08-26 Fixed in 2.4.0 CWE-94
Priority LOW 35

NVIDIA NeMo Framework for Linux contains a vulnerability where an attacker may cause deserialization of untrusted data.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00161 Published 2026-06-16 No fix listed CWE-502
TI-2026-19470 CVE-2026-24155 · GHSA-xp23-6mrm-wqh3

Code injection in NVIDIA NeMo Framework

Priority LOW 35

NVIDIA NeMo Framework for all platforms contains a code injection vulnerability.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00193 Published 2026-06-16 No fix listed CWE-94
Load more
Open these records in search →