NVIDIA NemoClaw

Patch now: confirmed exploitation or KEV · 0

Records at severity 3–4 (exploitation confirmed by CISA, the vendor or reporting) and records flagged as listed in CISA KEV. The KEV flag is the classifier’s cisa-kev tag or a source on the KEV catalog; it is recorded when the collector sees the listing, so a missing flag does not mean a CVE is absent from the catalog.

No record for NVIDIA NemoClaw has confirmed exploitation or a KEV flag.

Disclosed CVEs, no confirmed exploitation · 14

1. 2026-08-25
   CVE-2026-65087

   CVE-2026-65087: Insufficiently protected credentials vulnerability in NVIDIA NemoClaw

   2 Disclosedinfra_vuln

   record AIR-2026-1306NVD ↗
2. 2026-08-25
   CVE-2026-65088

   CVE-2026-65088: Sensitive information disclosure vulnerability in NVIDIA NemoClaw

   2 Disclosedinfra_vuln

   record AIR-2026-1305NVD ↗
3. 2026-08-25
   CVE-2026-65098

   CVE-2026-65098: Remote-access vulnerability in NVIDIA NemoClaw

   2 Disclosedinfra_vuln

   record AIR-2026-1304NVD ↗
4. 2026-08-25
   CVE-2026-65082

   CVE-2026-65082: Code injection vulnerability in NVIDIA NemoClaw migration command

   2 Disclosedcode-injection

   record AIR-2026-1303NVD ↗
5. 2026-08-25
   CVE-2026-65105

   CVE-2026-65105: Unauthenticated access vulnerability in NVIDIA NemoClaw inference server

   2 Disclosedunauthenticated-access

   record AIR-2026-1302NVD ↗
6. 2026-08-25
   CVE-2026-65099

   CVE-2026-65099: OS command injection vulnerability in NVIDIA NemoClaw CLI

   2 Disclosedcommand-injection

   record AIR-2026-1301NVD ↗
7. 2026-08-25
   CVE-2026-65090

   CVE-2026-65090: OS command injection vulnerability in NVIDIA NemoClaw NIM management

   2 Disclosedcommand-injection

   record AIR-2026-1300NVD ↗
8. 2026-08-25
   CVE-2026-65089

   CVE-2026-65089: OS command injection vulnerability in NVIDIA NemoClaw

   2 Disclosedcommand-injection

   record AIR-2026-1299NVD ↗
9. 2026-08-25
   CVE-2026-65096

   CVE-2026-65096: NVIDIA NemoClaw Telegram bridge OS command injection

   2 Disclosednvidia · command-injection

   record AIR-2026-1298NVD ↗
10. 2026-08-25
    CVE-2026-65084

    CVE-2026-65084: NVIDIA NemoClaw improper certificate validation

    2 Disclosednvidia · certificate-validation

    record AIR-2026-1297NVD ↗
11. 2026-08-25
    CVE-2026-65097

    CVE-2026-65097: NVIDIA NemoClaw insecure code download vulnerability

    2 Disclosednvidia · insecure-download

    record AIR-2026-1296NVD ↗
12. 2026-08-25
    CVE-2026-65081

    CVE-2026-65081: NVIDIA NemoClaw installation untrusted code execution

    2 Disclosednvidia · code-execution

    record AIR-2026-1295NVD ↗
13. 2026-04-28
    CVE-2026-24231

    NVIDIA NeMoClaw validateEndpointUrl SSRF vulnerability

    2 Disclosednemoclaw · ssrf

    record AIR-2026-1050NVD ↗
14. 2026-04-28
    CVE-2026-24222

    NVIDIA NeMoClaw sandbox initialization access control vulnerability

    2 Disclosednemoclaw · sandbox · information-disclosure

    record AIR-2026-1049NVD ↗