Advisories
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
79 items
NVIDIA Model-Optimizer contains a deserialization of untrusted data vulnerability, tracked as CVE-2026-65142, that an attacker may trigger. A successful exploit might lead to code execution, data tampering, denial of service, and information disclosure.
langchain-nvidia-ai-endpoints versions before 1.4.2 accepted local filesystem paths as image inputs for Vision Language Model requests. An attacker who controls image input passed to ChatNVIDIA or VLM reranking APIs can read files the application process can access and send them to the configured NVIDIA/NIM model endpoint.
Fix: Upgrade to langchain-nvidia-ai-endpoints >= 1.4.2, which rejects raw local filesystem paths for VLM image inputs. If upgrading is not immediately possible, reject local filesystem paths in user-controlled VLM image inputs, allow only trusted remote URLs, data URIs, or known safe asset/file IDs, and run the application with least-privilege filesystem access.
NVIDIA Triton Inference Server for Linux contains a vulnerability in which an attacker could abuse missing authorization. A successful exploit might lead to information disclosure, data tampering, and denial of service.
NVIDIA Triton Inference Server for Linux contains a vulnerability (CVE-2026-16497) that lets an attacker cause excessive iteration. A successful exploit might lead to denial of service.
NVIDIA Triton Inference Server for Linux contains an absolute path traversal vulnerability, tracked as CWE-36. A successful exploit might lead to code execution. The NVD assessment has not yet been provided, and NVIDIA published the advisory under its product-security repository.
NVIDIA Triton Inference Server for Linux contains an improper input validation flaw, tracked as CVE-2026-47629 and classified as CWE-20. A successful exploit might lead to denial of service. NVD has not yet provided an assessment, and the source names no affected versions.
NVIDIA Triton Inference Server for Linux contains a vulnerability, tracked as CVE-2026-47628 and classified as CWE-770 (Allocation of Resources Without Limits or Throttling). An attacker could cause an allocation of resources without limits, and a successful exploit might lead to denial of service. NVD had not yet provided an assessment at the time of the record.
CVE-2026-47627 affects NVIDIA Triton Inference Server for Linux and is classified as CWE-22, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). The source states that an attacker could cause path traversal, and a successful exploit might lead to denial of service. NVD had not yet provided an assessment when the entry was published on 08/18/2026.
NVIDIA Triton Inference Server for Linux contains an absolute path traversal vulnerability, tracked as CWE-36. A successful exploit might lead to code execution and information disclosure. NVD has not yet provided an assessment.
NVIDIA Triton Inference Server for Linux contains a path traversal flaw (CWE-22). A user can supply a path in the model name to the Triton MLflow plugin and reach files outside the model repository, allowing reads, writes or modifications. A successful exploit might lead to denial of service and information disclosure.
CVE-2026-47475 affects NVIDIA TensorRT-LLM's OpenAI-compatible inference API. An attacker can trigger a reachable assertion, classified as CWE-617, in the sampler thread. A successful exploit might lead to denial of service.
NVIDIA TensorRT-LLM contains a vulnerability in its OpenAI-compatible inference API, tracked as CVE-2026-24271 and classified as CWE-770 (Allocation of Resources Without Limits or Throttling). An attacker could cause allocation of GPU resources without limits or throttling, which might lead to denial of service. The NVD assessment has not yet been provided, and the record was published 07/14/2026.
NVIDIA TensorRT-LLM for Linux contains a vulnerability in the restricted unpickler used for model weight deserialization. A local, unauthenticated attacker could cause deserialization of untrusted data (CWE-502), which might lead to code execution, escalation of privileges, data tampering, and information disclosure.
CVE-2026-47482 affects NVIDIA Triton Inference Server for Linux. An attacker can cause missing release of memory after effective lifetime, classified as CWE-401. A successful exploit might lead to denial of service. NVD has not yet provided an assessment.
CVE-2026-47481 affects NVIDIA Triton Inference Server for Linux and is classified as CWE-288, Authentication Bypass Using an Alternate Path or Channel. An attacker can bypass authentication through an alternative path or channel. A successful exploit might lead to code execution, escalation of privileges, information disclosure, and data tampering.
NVIDIA Triton Inference Server for Linux contains a vulnerability, CVE-2026-47480, in which an attacker can cause an uncaught exception. The source states that a successful exploit might lead to denial of service. The weakness is classified as CWE-248 (Uncaught Exception), and NVD had not yet provided an assessment at publication on 07/14/2026.
NVIDIA Triton Inference Server for Linux contains a vulnerability, tracked as CVE-2026-47479 and classified as CWE-400 (Uncontrolled Resource Consumption). An attacker can cause uncontrolled resource consumption, which might lead to denial of service. NIST has not yet provided an NVD assessment, and the CVE was published on 07/14/2026.
NVIDIA Triton Inference Server for Linux contains a vulnerability, tracked as CVE-2026-47478 and classified as CWE-910 (Use of Expired File Descriptor). An attacker can cause the server to use an expired file descriptor, which might lead to denial of service.
CVE-2026-47477 affects NVIDIA Triton Inference Server for Linux. An attacker can cause a stack-based buffer overflow (CWE-121) in it, which might lead to denial of service. NVD has not yet provided an assessment, and the source gives no affected versions.
NVIDIA Triton Inference Server for Linux contains a vulnerability, CVE-2026-47476, classified as CWE-400 Uncontrolled Resource Consumption. An attacker can cause uncontrolled resource consumption, which might lead to denial of service. The NVD published the entry on 07/14/2026.