CVE Vulnerability Catalog

NVIDIA NemoClaw for Linux contains a vulnerability in the Telegram bridge component, where an attacker could cause an OS command injection. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.

NVIDIA OpenShell for Linux contains a vulnerability that could allow an attacker to escape the sandbox. Successful exploitation might lead to code execution, privilege escalation, data tampering, and information disclosure.

NVIDIA OpenShell Sandbox for Linux contains a vulnerability where an attacker could cause a path traversal bypass of L7 REST network policy. A successful exploit of this vulnerability might lead to information disclosure and data tampering.

NVIDIA OpenShell for all platforms contains a vulnerability where a malicious gateway could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.

NVIDIA NemoClaw for Linux contains a vulnerability in its NIM management component that allows an attacker to perform OS command injection. Successful exploitation could lead to code execution, data tampering, information disclosure, and denial of service.

NVIDIA NemoClaw for Linux contains a vulnerability in its status and logs plugin commands that allows an attacker to perform OS command injection. Successful exploitation could lead to code execution, data tampering, information disclosure, and denial of service.

NVIDIA NemoClaw contains a vulnerability where an attacker could cause insufficiently protected credentials. A successful exploit might lead to information disclosure and data tampering.

NVIDIA OpenShell for Linux contains a vulnerability in its sandbox exec handler, where an attacker could cause an OS command injection. A successful exploit might lead to code execution, information disclosure, and data tampering.

NVIDIA OpenShell for Linux contains a vulnerability in its inference proxy, where an attacker could cause an improper encoding or escaping of output. A successful exploit might lead to information disclosure and data tampering.

NVIDIA NemoClaw for Linux contains a vulnerability in its deployment process that allows an attacker to cause improper certificate validation. Successful exploitation could lead to information disclosure, data tampering, code execution, and escalation of privileges.

NVIDIA OpenShell for Linux contains a vulnerability in its sandbox provisioning API, where an attacker could cause an incomplete list of disallowed inputs. Successful exploitation might lead to code execution, privilege escalation, information disclosure, data tampering, and denial of service.

NVIDIA NemoClaw for Linux contains a vulnerability in its migration command that allows a local attacker to perform code injection. Successful exploitation could lead to code execution, data tampering, information disclosure, and denial of service.

NVIDIA NemoClaw for Linux contains a vulnerability in its installation process that allows an attacker to cause execution of untrusted code. Successful exploitation could lead to code execution, escalation of privileges, data tampering, information disclosure, and denial of service.

ORAS CLI up to version 1.3.2 has a vulnerability to uncontrolled recursion during referrer traversal when a malicious OCI registry returns a cyclic referrer graph. This causes unbounded memory growth and process hang, which can be exploited for a client-side denial of service.

MCP PHP SDK versions 0.5.0 through 0.7.0 have a vulnerability to unbounded buffer growth in the HTTP transport when reading a Server-Sent Events stream. A malicious MCP server can send data without delimiters, causing client process memory exhaustion.

An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the libtiff/tools/thumbnail.c: main() component.

Buffer Overflow vulnerability in gpac 31becc9e08b88e525a4a62013a4000de1c0f8fd9 allows an attacker to execute arbitrary code via the svgNameToImplementationName() function.

An issue in Beijing Tongtech Co., Ltd tongweb v.7.0.24 in the Spring HttpInovkerServiceExporter component allows a remote attacker to execute arbitrary code via a crafted request to the console/heimdall endpoint.

A buffer overflow vulnerability in SQLite affects source snapshots/builds containing a specific Fossil check-in. An attacker can exploit this to cause a denial of service via components related to the sqlar_uncompress function.

The Okta Privileged Access client does not reject a leading hyphen in the username portion of an SSH target, which may cause the value to be interpreted as a command-line option by the underlying SSH process.