GCD AI RADAR
products/nvidia-nemo

NVIDIA NeMo

Filed as: NVIDIA NeMo Framework, NeMo Framework, NVIDIA NeMo Speech, NVIDIA NeMo Agent Toolkit, NVIDIA NeMo Curator, NVIDIA Nemo Framework

Records
41
Disclosed CVEs
41
Exploited (sev 3–4)
0
CISA KEV flagged
0

Newest record 2026-09-22 · 41 distinct CVE ids · open in the explorer (the explorer matches the first product a record names, so it can list fewer)

Patch now: confirmed exploitation or KEV · 0

Records at severity 3–4 (exploitation confirmed by CISA, the vendor or reporting) and records flagged as listed in CISA KEV. The KEV flag is the classifier’s cisa-kev tag or a source on the KEV catalog; it is recorded when the collector sees the listing, so a missing flag does not mean a CVE is absent from the catalog.

No record for NVIDIA NeMo has confirmed exploitation or a KEV flag.

Disclosures by month · last 24 months

Nov ’2438 disclosed · peak 10 in Feb ’26Oct ’26

Disclosed CVEs, no confirmed exploitation · 41

  1. 2026-09-22
    CVE-2026-65111
    CVE-2026-65111: NVIDIA NeMo Speech Code Injection Vulnerability
    2 Disclosednvidia-nemo · code-injection
    record AIR-2026-0194NVD ↗
  2. 2026-09-22
    CVE-2026-24239
    CVE-2026-24239: NVIDIA NeMo Speech Remote Code Execution Vulnerability
    2 Disclosednvidia-nemo · rce
    record AIR-2026-0193NVD ↗
  3. 2026-09-22
    CVE-2026-65178
    CVE-2026-65178: NVIDIA NeMo Vulnerability Allows Code Execution via Malicious Config
    2 Disclosednvidia-nemo · remote-code-execution
    record AIR-2026-0192NVD ↗
  4. 2026-09-22
    CVE-2026-65179
    CVE-2026-65179: Insecure pickle deserialization in NVIDIA NeMo
    2 Disclosedinsecure-deserialization · nvidia-nemo
    record AIR-2026-0191NVD ↗
  5. 2026-09-22
    CVE-2026-24267
    CVE-2026-24267: Remote code execution in NVIDIA NeMo Speech
    2 Disclosedrce · nvidia-nemo
    record AIR-2026-0190NVD ↗
  6. 2026-07-27
    CVE-2026-24252
    CVE-2026-24252: OS command injection vulnerability in NVIDIA NeMo for Linux
    2 Disclosedinfra_vuln
    record AIR-2026-1217NVD ↗
  7. 2026-06-16
    CVE-2026-24155
    CVE-2026-24155: NVIDIA NeMo Framework contains code injection vulnerability
    2 Disclosednvidia-nemo · code-injection
    record AIR-2026-1113NVD ↗
  8. 2026-06-16
    CVE-2026-24228
    CVE-2026-24228: NVIDIA NeMo Framework vulnerable to insecure deserialization
    2 Disclosednvidia-nemo · deserialization
    record AIR-2026-1112NVD ↗
  9. 2026-03-24
    CVE-2026-24159
    CVE-2026-24159: NVIDIA NeMo Framework remote code execution vulnerability
    2 Disclosedrce
    record AIR-2026-1000NVD ↗
  10. 2026-03-24
    CVE-2026-24157
    CVE-2026-24157: NVIDIA NeMo Framework checkpoint loading vulnerability allows RCE
    2 Disclosedrce
    record AIR-2026-0998NVD ↗
  11. 2026-02-18
    CVE-2025-33252
    CVE-2025-33252: RCE vulnerability in NVIDIA NeMo Framework
    2 Disclosedrce · nemo
    record AIR-2026-0973NVD ↗
  12. 2026-02-18
    CVE-2025-33251
    CVE-2025-33251: RCE vulnerability in NVIDIA NeMo Framework
    2 Disclosedrce · nemo
    record AIR-2026-0972NVD ↗
  13. 2026-02-18
    CVE-2025-33250
    CVE-2025-33250: RCE vulnerability in NVIDIA NeMo Framework
    2 Disclosedrce · nemo
    record AIR-2026-0971NVD ↗
  14. 2026-02-18
    CVE-2025-33245
    CVE-2025-33245: NVIDIA NeMo Framework RCE Vulnerability
    2 Disclosedrce
    record AIR-2026-0970NVD ↗
  15. 2026-02-18
    CVE-2025-33236
    CVE-2025-33236: NVIDIA NeMo Framework Code Injection Vulnerability
    2 Disclosedcode-injection
    record AIR-2026-0969NVD ↗
  16. 2026-02-18
    CVE-2025-33243
    CVE-2025-33243: NVIDIA NeMo Framework Distributed RCE Vulnerability
    2 Disclosedrce
    record AIR-2026-0968NVD ↗
  17. 2026-02-18
    CVE-2025-33241
    CVE-2025-33241: NVIDIA NeMo Framework RCE Vulnerability
    2 Disclosedrce
    record AIR-2026-0967NVD ↗
  18. 2026-02-18
    CVE-2025-33253
    CVE-2025-33253: NVIDIA NeMo Framework RCE Vulnerability
    2 Disclosedrce
    record AIR-2026-0966NVD ↗
  19. 2026-02-18
    CVE-2025-33249
    CVE-2025-33249: Code injection vulnerability in NVIDIA NeMo Framework
    2 Disclosedcode-injection
    record AIR-2026-0965NVD ↗
  20. 2026-02-18
    CVE-2025-33246
    CVE-2025-33246: Command injection vulnerability in NVIDIA NeMo Framework
    2 Disclosedcommand-injection
    record AIR-2026-0964NVD ↗
  21. 2025-12-16
    CVE-2025-33226
    CVE-2025-33226: NVIDIA NeMo Framework Code Injection Vulnerability
    2 Disclosednvidia · nemo · code-injection
    record AIR-2025-0510NVD ↗
  22. 2025-12-16
    CVE-2025-33212
    CVE-2025-33212: NVIDIA NeMo Framework Model Loading Vulnerability
    2 Disclosednvidia · nemo · rce
    record AIR-2025-0509NVD ↗
  23. 2025-11-25
    CVE-2025-33203
    NVIDIA NeMo Agent Toolkit SSRF Vulnerability CVE-2025-33203
    2 Disclosedssrf · infra_vuln
    record AIR-2025-0504NVD ↗
  24. 2025-11-25
    CVE-2025-33205
    CVE-2025-33205: NVIDIA NeMo Framework Variable Inclusion Vulnerability
    2 Discloseduntrusted-inclusion · code-execution
    record AIR-2025-0503NVD ↗
  25. 2025-11-25
    CVE-2025-33204
    CVE-2025-33204: NVIDIA NeMo Framework Code Injection Vulnerability
    2 Disclosedcode-injection · llm-security
    record AIR-2025-0502NVD ↗
  26. 2025-11-11
    CVE-2025-33178
    CVE-2025-33178: Code injection vulnerability in NVIDIA NeMo bert services
    2 Disclosedcode-injection · nvidia
    record AIR-2025-0498NVD ↗
  27. 2025-11-11
    CVE-2025-23361
    CVE-2025-23361: Script vulnerability in NVIDIA NeMo Framework
    2 Disclosednvidia · code-generation
    record AIR-2025-0497NVD ↗
  28. 2025-08-26
    CVE-2025-23307
    CVE-2025-23307: NVIDIA NeMo Curator code injection vulnerability
    2 Disclosedcode-injection · nvidia
    record AIR-2025-0476NVD ↗
  29. 2025-08-26
    CVE-2025-23314
    CVE-2025-23314: NVIDIA NeMo Framework code injection vulnerability
    2 Disclosedcode-injection · nvidia
    record AIR-2025-0475NVD ↗
  30. 2025-08-26
    CVE-2025-23313
    CVE-2025-23313: NVIDIA NeMo Framework code injection vulnerability
    2 Disclosedcode-injection · nvidia
    record AIR-2025-0474NVD ↗
  31. 2025-08-26
    CVE-2025-23312
    CVE-2025-23312: NVIDIA NeMo Framework Retrieval Services Code Injection
    2 Disclosedcode-injection · rce
    record AIR-2025-0473NVD ↗
  32. 2025-08-26
    CVE-2025-23315
    CVE-2025-23315: NVIDIA NeMo Framework Export Component Code Injection
    2 Disclosedcode-injection · rce
    record AIR-2025-0472NVD ↗
  33. 2025-08-13
    CVE-2025-23303
    CVE-2025-23303: NVIDIA NeMo Framework Deserialization Vulnerability
    2 Discloseddeserialization · rce
    record AIR-2025-0470NVD ↗
  34. 2025-08-13
    CVE-2025-23304
    CVE-2025-23304: NVIDIA NeMo Model Loading Code Injection Vulnerability
    2 Disclosedcode-injection · remote-code-execution · nemo
    record AIR-2025-0468NVD ↗
  35. 2025-04-22
    CVE-2025-23249
    CVE-2025-23249: Deserialization Vulnerability in NVIDIA NeMo Framework
    2 Discloseddeserialization · rce
    record AIR-2025-0419NVD ↗
  36. 2025-04-22
    CVE-2025-23251
    CVE-2025-23251: Remote Code Execution Vulnerability in NVIDIA NeMo
    2 Disclosedrce
    record AIR-2025-0418NVD ↗
  37. 2025-04-22
    CVE-2025-23250
    CVE-2025-23250: Path Traversal Vulnerability in NVIDIA NeMo Framework
    2 Disclosedpath-traversal · rce
    record AIR-2025-0417NVD ↗
  38. 2025-03-11
    CVE-2025-23360
    CVE-2025-23360: NVIDIA Nemo Framework path traversal vulnerability
    2 Disclosedpath-traversal
    record AIR-2025-0400NVD ↗
  39. 2024-10-15
    CVE-2024-0129
    CVE-2024-0129: NVIDIA NeMo path traversal vulnerability
    2 Disclosedpath-traversal · nemo
    record AIR-2024-0261NVD ↗
  40. 2024-04-05
    CVE-2024-0081
    CVE-2024-0081: NVIDIA NeMo Framework Denial of Service Vulnerability
    2 Discloseddenial-of-service
    record AIR-2024-0222NVD ↗
  41. 2022-01-10
    CVE-2022-22821
    CVE-2022-22821: NVIDIA NeMo ASR WebApp Path Traversal
    2 Disclosedpath-traversal · nvidia-nemo
    record AIR-2022-0101NVD ↗

This page lists what has been reported, not what to do about it. Versions and fixes are in each linked advisory; check the vendor’s own advisory before acting.