Baitaphish
Security intelligence
SearchLatest briefing
Data & Insights

CVE Explorer

Search one exact, source-linked CVE snapshot by CVE ID or explicit vendor and product tokens. Provider severity, KEV, conflicts, and stale state remain separate observations—not a Baitaphish risk rating.
Snapshot urn:baitaphish:cve-read-model-snapshot:v3:f2c3f72dcc196f8e7d63aa2d29709ad8b3fea39110eb2d563da5ce9b6fa9da89Released 2026-08-05T02:00:00Z
Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-24293

Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows 11 Version 24H2, Windows 11 Version 23H2, Windows 11 version 23H2, Windows Server 2025 (Server Core installation), Windows Server 2022, Windows 11 version 26H1, Windows 10 Version 21H2, Windows Server 2025, Windows 11 Version 25H2, Windows 10 Version 22H2, Windows Server 2022, 23H2 Edition (Server Core installation)
Provider severity
HIGH
Conflicts
1

CVE-2026-24292

Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows Server 2022, Windows 10 Version 21H2, Windows Server 2025 (Server Core installation), Windows 11 Version 25H2, Windows 10 Version 22H2, Windows 11 Version 23H2, Windows 11 version 26H1, Windows Server 2019 (Server Core installation), Windows Server 2019, Windows 11 version 22H3, Windows 11 Version 24H2, Windows 10 Version 1809, Windows Server 2025, Windows Server 2022, 23H2 Edition (Server Core installation)
Provider severity
HIGH
Conflicts
1

CVE-2026-24291

Incorrect permission assignment for critical resource in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows Server 2012, Windows Server 2022, Windows Server 2012 R2 (Server Core installation), Windows Server 2019, Windows Server 2016 (Server Core installation), Windows Server 2012 (Server Core installation), Windows Server 2016, Windows Server 2025, Windows 10 Version 1809, Windows Server 2025 (Server Core installation), Windows Server 2012 R2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 23H2, Windows 10 Version 21H2, Windows 11 Version 24H2, Windows 11 version 26H1, Windows 11 Version 25H2, Windows 10 Version 1607, Windows Server 2019 (Server Core installation), Windows 10 Version 22H2, Windows 11 version 22H3
Provider severity
HIGH
Conflicts
1

CVE-2026-24290

Improper access control in Windows Projected File System allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows 10 Version 1809, Windows 11 version 22H3, Windows 10 Version 21H2, Windows Server 2025 (Server Core installation), Windows Server 2022, Windows Server 2025, Windows 11 Version 24H2, Windows 11 Version 23H2, Windows 11 version 26H1, Windows 10 Version 22H2, Windows Server 2019 (Server Core installation), Windows Server 2019, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 25H2
Provider severity
HIGH
Conflicts
1

CVE-2026-2429

The Community Events plugin for WordPress is vulnerable to SQL Injection via the 'ce_venue_name' CSV field in the `on_save_changes_venues` function in all versions up to, and including, 1.5.8. This is due to insufficient escaping on the user-supplied CSV data and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to

PUBLISHED
Vendor
jackdewey
Product
Community Events
Provider severity
MEDIUM
Conflicts
0

CVE-2026-24289

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows Server 2012 R2, Windows 10 Version 22H2, Windows 11 version 26H1, Windows Server 2012, Windows Server 2012 R2 (Server Core installation), Windows Server 2025, Windows 11 Version 24H2, Windows 10 Version 1809, Windows Server 2022, Windows Server 2019 (Server Core installation), Windows Server 2012 (Server Core installation), Windows 10 Version 1607, Windows 11 Version 25H2, Windows 11 version 23H2, Windows 10 Version 21H2, Windows Server 2016, Windows Server 2025 (Server Core installation), Windows Server 2019, Windows Server 2016 (Server Core installation), Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation)
Provider severity
HIGH
Conflicts
1

CVE-2026-24288

Heap-based buffer overflow in Windows Mobile Broadband allows an unauthorized attacker to execute code with a physical attack.

PUBLISHED
Vendor
Microsoft, Microsoft
Product
Windows 10 Version 22H2, Windows 10 Version 21H2
Provider severity
MEDIUM
Conflicts
1

CVE-2026-24287

External control of file name or path in Windows Kernel allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows Server 2022, Windows Server 2025 (Server Core installation), Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 version 26H1, Windows Server 2019, Windows 10 Version 21H2, Windows 11 version 22H3, Windows 11 Version 24H2, Windows 11 Version 25H2, Windows Server 2019 (Server Core installation), Windows 10 Version 22H2, Windows 11 Version 23H2, Windows 10 Version 1809, Windows Server 2025
Provider severity
HIGH
Conflicts
1

CVE-2026-24285

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows Server 2016, Windows Server 2019, Windows Server 2025, Windows Server 2012 R2, Windows Server 2012, Windows Server 2012 (Server Core installation), Microsoft Office for Android, Windows 10 Version 21H2, Windows 11 version 22H3, Windows Server 2012 R2 (Server Core installation), Windows Server 2019 (Server Core installation), Windows Server 2025 (Server Core installation), Windows Server 2016 (Server Core installation), Windows Server 2022, Windows 10 Version 22H2, Windows 11 Version 24H2, Windows 10 Version 1809, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 10 Version 1607, Windows 11 Version 23H2, Windows 11 Version 25H2
Provider severity
HIGH
Conflicts
1

CVE-2026-24283

Heap-based buffer overflow in Windows File Server allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows 11 version 26H1, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows Server 2025 (Server Core installation), Windows 11 Version 25H2
Provider severity
HIGH
Conflicts
1

CVE-2026-24282

Out-of-bounds read in Push Message Routing Service allows an authorized attacker to disclose information locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows 10 Version 1607, Windows 11 version 22H3, Windows 11 Version 23H2, Windows 10 Version 21H2, Windows 10 Version 1809, Windows 11 Version 25H2, Windows 11 Version 24H2, Windows 11 version 26H1, Windows 10 Version 22H2
Provider severity
MEDIUM
Conflicts
1

CVE-2026-24281

Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introduc

PUBLISHED
Vendor
Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Apache Software Foundation, Red Hat, Red Hat
Product
Red Hat build of Debezium 3, Red Hat OpenShift AI (RHOAI), Red Hat Offline Knowledge Portal, Red Hat build of Apache Camel for Spring Boot 4, Red Hat AMQ Broker 7.12.7, Red Hat JBoss Enterprise Application Platform 7, Streams for Apache Kafka 2.9.4, Red Hat AMQ Broker 7.14.0, Red Hat JBoss Enterprise Application Platform 8, streams for Apache Kafka 3, Red Hat Fuse 7, Red Hat Data Grid 8, Red Hat AMQ Broker 7.13.5, Red Hat JBoss Enterprise Application Platform Expansion Pack, Apache ZooKeeper, Red Hat OpenShift AI 2.25, Red Hat build of Debezium 2
Provider severity
HIGH, MEDIUM
Conflicts
3

CVE-2026-2428

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 6.1.17. This is due to the PayPal IPN (Instant Payment Notification) verification being disabled by default (`disable_ipn_verification` defaults to `'yes'` in `PayPalSettings.php`). This makes it possible for unauthenticated attackers to send forged PayPal IPN notifications to the publicly accessible IPN endpoint, marking unpaid form submissi

PUBLISHED
Vendor
techjewel
Product
Fluent Forms Pro Add On Pack
Provider severity
HIGH
Conflicts
0

CVE-2026-24272

NVIDIA TensorRT contains a vulnerability where an attacker might cause an overflow to a heap-based buffer. A successful exploit of this vulnerability might lead to code execution.

PUBLISHED
Vendor
NVIDIA
Product
TensorRT
Provider severity
HIGH
Conflicts
0

CVE-2026-24271

NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API, where an attacker could cause allocation of GPU resources without limits or throttling. A successful exploit of this vulnerability might lead to denial of service.

PUBLISHED
Vendor
NVIDIA
Product
TensorRT-LLM
Provider severity
MEDIUM
Conflicts
0

CVE-2026-24270

NVIDIA AIStore framework contains a vulnerability where an attacker could bypass authentication. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, and data tampering.

PUBLISHED
Vendor
NVIDIA
Product
AIStore framework
Provider severity
CRITICAL
Conflicts
0

CVE-2026-2427

The itsukaita plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'day_from' and 'day_to' parameters in all versions up to, and including, 0.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.

PUBLISHED
Vendor
kazunii
Product
itsukaita
Provider severity
MEDIUM
Conflicts
0

CVE-2026-24268

NVIDIA TensorRT contains a vulnerability where an attacker might cause a heap-based buffer overflow. A successful exploit of this vulnerability might lead to code execution.

PUBLISHED
Vendor
NVIDIA
Product
TensorRT
Provider severity
HIGH
Conflicts
0

CVE-2026-24266

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a use-after-free issue. A successful exploit of this vulnerability might lead to denial of service.

PUBLISHED
Vendor
NVIDIA
Product
Triton Inference Server
Provider severity
MEDIUM
Conflicts
0

CVE-2026-24264

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause improper handling of highly compressed data. A successful exploit of this vulnerability might lead to denial of service.

PUBLISHED
Vendor
NVIDIA
Product
Triton Inference Server
Provider severity
HIGH
Conflicts
0

CVE-2026-24260

NVIDIA Container Toolkit for Linux contains a vulnerability where an attacker could cause a time-of-check time-of-use race condition. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, and data tampering.

PUBLISHED
Vendor
NVIDIA, NVIDIA
Product
Container Toolkit, GPU Operator
Provider severity
HIGH
Conflicts
1

CVE-2026-2426

The WP-DownloadManager plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.69 via the 'file' parameter in the file deletion functionality. This is due to insufficient validation of user-supplied file paths, allowing directory traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can lead to remote code execution when critical files like wp-config.p

PUBLISHED
Vendor
gamerz
Product
WP-DownloadManager
Provider severity
MEDIUM
Conflicts
0

CVE-2026-24259

NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause missing authentication for a critical function. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.

PUBLISHED
Vendor
NVIDIA
Product
TensorRT-LLM
Provider severity
MEDIUM
Conflicts
0

CVE-2026-24252

NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A successful exploit of this vulnerability may lead to code execution, data tampering, escalation of privileges and information disclosure.

PUBLISHED
Vendor
NVIDIA
Product
NeMo Framework
Provider severity
HIGH
Conflicts
0

CVE-2026-24251

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of dynamically managed code resources. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

PUBLISHED
Vendor
NVIDIA
Product
Megatron-Bridge
Provider severity
HIGH
Conflicts
0

CVE-2026-24250

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper validation of allowed inputs. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

PUBLISHED
Vendor
NVIDIA
Product
Megatron-Bridge
Provider severity
HIGH
Conflicts
0

CVE-2026-2425

The hiWeb Migration Simple plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'new_domain' parameter in all versions up to, and including, 2.0.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.

PUBLISHED
Vendor
den-media
Product
hiWeb Migration Simple
Provider severity
MEDIUM
Conflicts
0

CVE-2026-24249

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

PUBLISHED
Vendor
NVIDIA
Product
Megatron-Bridge
Provider severity
HIGH
Conflicts
0

CVE-2026-24248

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of code generation. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

PUBLISHED
Vendor
NVIDIA
Product
Megatron-Bridge
Provider severity
HIGH
Conflicts
0

CVE-2026-24247

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

PUBLISHED
Vendor
NVIDIA
Product
Megatron-Bridge
Provider severity
HIGH
Conflicts
0

CVE-2026-24246

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of dynamically managed code resources. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

PUBLISHED
Vendor
NVIDIA
Product
Megatron-Bridge
Provider severity
HIGH
Conflicts
0

CVE-2026-24245

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

PUBLISHED
Vendor
NVIDIA
Product
Megatron-Bridge
Provider severity
HIGH
Conflicts
0

CVE-2026-24244

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

PUBLISHED
Vendor
NVIDIA
Product
Megatron-Bridge
Provider severity
HIGH
Conflicts
0

CVE-2026-24243

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

PUBLISHED
Vendor
NVIDIA
Product
Megatron-Bridge
Provider severity
HIGH
Conflicts
0

CVE-2026-24242

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure.

PUBLISHED
Vendor
NVIDIA
Product
Megatron-Bridge
Provider severity
HIGH
Conflicts
0

CVE-2026-24241

NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an attacker could exploit an improper authentication issue. A successful exploit of this vulnerability might lead to information disclosure.

PUBLISHED
Vendor
NVIDIA, NVIDIA
Product
DLS component of NVIDIA License System, DLS component of NVIDIA License System
Provider severity
MEDIUM
Conflicts
1

CVE-2026-24240

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

PUBLISHED
Vendor
NVIDIA
Product
Megatron-Bridge
Provider severity
HIGH
Conflicts
0

CVE-2026-2424

The Reward Video Ad for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6. This is due to insufficient input sanitization and output escaping on plugin settings such as the 'Account ID', 'Message before the video', and color fields. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a

PUBLISHED
Vendor
applixir
Product
Reward Video Ad for WordPress
Provider severity
MEDIUM
Conflicts
0

CVE-2026-24238

NVIDIA TensorRT for contains a vulnerability where an attacker might cause an improper validation of array index. A successful exploit of this vulnerability might lead to code execution.

PUBLISHED
Vendor
NVIDIA
Product
TensorRT
Provider severity
HIGH
Conflicts
0

CVE-2026-24237

NVIDIA NVTabular contains a vulnerability where an attacker could cause improper deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.

PUBLISHED
Vendor
NVIDIA
Product
NVTabular
Provider severity
HIGH
Conflicts
0

CVE-2026-24234

NVIDIA TensorRT-LLM for Linux contains a vulnerability in the multimodal media fetching functions, where a network-accessible attacker could cause server-side request forgery. A successful exploit of this vulnerability might lead to denial of service and information disclosure.

PUBLISHED
Vendor
NVIDIA
Product
TensorRT-LLM
Provider severity
MEDIUM
Conflicts
0

CVE-2026-24233

NVIDIA TensorRT-LLM for Linux contains a vulnerability in the restricted unpickler used for model weight deserialization, where a local, unauthenticated attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

PUBLISHED
Vendor
NVIDIA
Product
TensorRT-LLM
Provider severity
HIGH
Conflicts
0

CVE-2026-24232

NVIDIA Tranformers4Rec contains a vulnerability where an attacker could cause improper deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.

PUBLISHED
Vendor
NVIDIA
Product
Tranformers4Rec
Provider severity
MEDIUM
Conflicts
0

CVE-2026-24231

NVIDIA NemoClaw contains a vulnerability in the validateEndpointUrl() SSRF protection component, where an attacker could cause a server-side request forgery by supplying a crafted endpoint URL referencing the 0.0.0.0/8 address range through a blueprint configuration file or CLI flag. A successful exploit of this vulnerability may lead to information disclosure.

PUBLISHED
Vendor
NVIDIA
Product
NemoClaw
Provider severity
MEDIUM
Conflicts
0

CVE-2026-24229

NVIDIA TensorRT-LLM for Linux contains a vulnerability in the disaggregated orchestrator component, where an attacker could read, write, or delete internal cluster state by sending requests to the FastAPI server. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.

PUBLISHED
Vendor
NVIDIA
Product
TensorRT-LLM
Provider severity
HIGH
Conflicts
0

CVE-2026-24228

NVIDIA NeMo Framework for Linux contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, data tampering, and information disclosure.

PUBLISHED
Vendor
NVIDIA
Product
NeMo Framework
Provider severity
HIGH
Conflicts
0

CVE-2026-24227

NVIDIA TensorRT for contains a vulnerability where a user might cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution.

PUBLISHED
Vendor
NVIDIA
Product
TensorRT
Provider severity
MEDIUM
Conflicts
0

CVE-2026-24226

NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause improper control of code generation. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.

PUBLISHED
Vendor
NVIDIA
Product
TensorRT-LLM
Provider severity
MEDIUM
Conflicts
0

CVE-2026-24222

NVIDIA NeMoClaw contains a vulnerability in the sandbox environment initialization component, where a remote attacker could cause improper access control by sending prompt-injected content that causes the agent to read and exfiltrate host environment variables not properly restricted during sandbox creation. A successful exploit of this vulnerability might lead to information disclosure.

PUBLISHED
Vendor
NVIDIA
Product
NemoClaw
Provider severity
HIGH
Conflicts
0

CVE-2026-24221

NVIDIA NVTabular contains a vulnerability where an attacker could cause improper deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering and information disclosure.

PUBLISHED
Vendor
NVIDIA
Product
NVTabular
Provider severity
HIGH
Conflicts
0