According to Security NEXT, NVIDIA disclosed two vulnerabilities in the NeMo Agent Toolkit on October 27, 2026, and released fixed versions [1]. CVE-2026-65145 stems from missing authentication and may lead to code execution, privilege escalation, data tampering, denial of service, or information disclosure, carrying a CVSS v3 score of 10.0 (Critical) [1]. CVE-2026-65151 is an SQL injection flaw that may result in data tampering, denial of service, or information disclosure, with a CVSS score of 8.4 (High) [1].
This event has not been officially confirmed. Content is based on media or third-party reports.
NVIDIA NeMo Agent Toolkit Patched for Vulnerabilities Reaching CVSS 10.0
1 min read
- Disclosed
- Nov 6, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 7, 2026
- CVSS basis
- [1]
- EPSS (chance of exploitation in 30 days)
- 0.5%, higher than 45% of CVEs
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Technology
What to do nowOur advice
CVE-2026-65151 is an SQL injection flaw that may result in data tampering, denial of service, or information disclosure, with a CVSS score of 8.4 (High) [1].
Timeline
- Security NEXT publishes report (date only; timestamp is a placeholder)[1]
Technical details
Verified Source Summary
NVIDIA disclosed two vulnerabilities in the NeMo Agent Toolkit on October 27, 2026, and released fixed versions [1].
CVE-2026-65145 stems from missing authentication and may lead to code execution, privilege escalation, data tampering, denial of service, or information disclosure, carrying a CVSS v3 score of 10.0 (Critical) [1].
CVE-2026-65151 is an SQL injection flaw that may result in data tampering, denial of service, or information disclosure, with a CVSS score of 8.4 (High) [1].
References
Media1
- [1]
“NVIDIAが提供するAIエージェント開発支援ツール「NeMo Agent Toolkit」に複数の脆弱性が明らかとなった。深刻な脆弱性も含まれており、同社は修正版を公開している。”
Expert help
Still not sure whether this affects you?
Tell us about your environment. We'll check it against this advisory, assess the risk, and give you concrete patch and monitoring steps.
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.