CVE Vulnerability Catalog

NVIDIA TensorRT-LLM contains a vulnerability that could allow an attacker to trigger a write-what-where condition. Successful exploitation may lead to data tampering, denial of service, and information disclosure.

A vulnerability in NVIDIA TensorRT-LLM's inter-process communication layer allows an attacker with local same-user access to trigger deserialization. Successful exploitation could lead to code execution, information disclosure, data tampering, and denial of service.

A vulnerability in NVIDIA TensorRT-LLM during tensor deserialization allows an attacker to trigger a heap-based buffer overflow. This could lead to information disclosure, data tampering, or denial of service.

NVIDIA TensorRT contains a vulnerability that may cause a heap-based buffer overflow. An attacker could exploit this flaw to achieve code execution.

A vulnerability in NVIDIA TensorRT allows an attacker to cause a heap-based buffer overflow, potentially leading to code execution.

A vulnerability in NVIDIA TensorRT allows an attacker to cause improper validation of an array index. Successful exploitation could lead to code execution.

NVIDIA TensorRT-LLM for Linux contains a vulnerability in the restricted unpickler used for model weight deserialization, allowing a local, unauthenticated attacker to deserialize untrusted data. Successful exploitation could lead to code execution, privilege escalation, data tampering, and information disclosure.

A vulnerability in NVIDIA TensorRT-LLM for Linux within the disaggregated orchestrator component allows an attacker to read, write, or delete internal cluster state by sending requests to the FastAPI server. Successful exploitation could lead to information disclosure, data tampering, and denial of service.

A use-after-free vulnerability in the UI component of Google Chrome on Linux prior to version 150.0.7871.125 was discovered. A remote attacker could convince a user to perform specific UI gestures, potentially exploiting heap corruption via a crafted HTML page.

Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

A Use-After-Free vulnerability in the Skia library in Google Chrome prior to 150.0.7871.125 allows a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. The issue is rated as High severity in the Chromium security assessment.

A Use-After-Free vulnerability in the GPU component of Google Chrome on Android prior to version 150.0.7871.125 was discovered. A remote attacker who had compromised the renderer process could exploit a crafted HTML page to perform a sandbox escape.

Insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

A heap buffer overflow vulnerability was found in the libyuv library in Google Chrome on Windows prior to version 150.0.7871.125. A remote attacker can exploit this by providing a crafted video file, leading to arbitrary code execution within the sandbox environment.

A use-after-free vulnerability was found in the Ozone component of Google Chrome prior to version 150.0.7871.125. A remote attacker could convince a user to perform specific UI gestures to potentially exploit heap corruption via a crafted HTML page.

A use-after-free vulnerability in the Ozone component of Google Chrome on Linux prior to version 150.0.7871.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page by convincing a user to perform specific UI gestures. The severity is rated as Critical by Chromium.

A vulnerability in Amazon AWS Load Balancer Controller before version 3.4.2, caused by incorrect behavior order in Gateway API listener-rule generation, allows an authenticated remote user to intercept, spoof, or deny another namespace's gRPC traffic on a shared Gateway via a crafted HTTPRoute resource.

A server-side request forgery (SSRF) vulnerability in the pagination component of AWS HealthLake MCP Server before version 0.0.14 allows a remote authenticated user to redirect pagination requests to an arbitrary endpoint. By crafting a malicious next_token parameter, an attacker can exfiltrate AWS temporary security credentials.

A resource allocation without limits or throttling vulnerability in .NET allows an unauthorized attacker to cause a denial of service over a network.

Code injection vulnerability in .NET Framework allows an unauthorized attacker to elevate privileges locally.