CVE-2026-65161

HighCVSS 7.5/10Last modified Oct 13, 2026

Description

NVIDIA AIStore for Linux contains a vulnerability in the Promote API where an unauthenticated remote attacker may read files accessible to the target process by supplying a crafted absolute source path. A successful exploit may lead to information disclosure.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 13, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-6516210.0NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supplyCVE-2026-651648.1NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remote attacker may causeCVE-2026-65177.7Mattermost Desktop App versions <=6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded to in theCVE-2026-651708.6NVIDIA AIStore for Linux contains a vulnerability in the experimental HT backend where an unauthenticated remote attacker may cause server-sCVE-2026-651728.6NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated reCVE-2026-651739.1NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote atCVE-2026-651787.8NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted model_config.yaml can inject unsafe parametCVE-2026-651798.8NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untrusted, attacker-controlled .pkl file via picCVE-2026-65188.8The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to arbitrary file upload and remote code executCVE-2026-651807.8NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciouCVE-2026-651818.1Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and crCVE-2026-651829.1Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a lo