NVIDIA Nvflare vulnerabilities

6 CVEs affecting NVIDIA Nvflare, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-24204, published 2026-04-28.

More from NVIDIA.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-34668, published 2022-08-29. Critical severity, CVSS 9.8. EPSS: 10.9% chance of exploitation in the next 30 days. NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacker to cause Remote Code Execution, Denial…
• CVE-2022-31605, published 2022-07-01. Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days. NVFLARE, versions prior to 2.1.2, contains a vulnerability in its utils module, where YAML files are loaded via yaml.load() instead of yaml.safe_load(). The deserialization of Untrusted Data, may…
• CVE-2022-31604, published 2022-07-01. Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days. NVFLARE, versions prior to 2.1.2, contains a vulnerability in its PKI implementation module, where The CA credentials are transported via pickle and no safe deserialization. The deserialization of…
• CVE-2026-24178, published 2026-04-28. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key. A…
• CVE-2026-24186, published 2026-04-28. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. NVIDIA FLARE SDK contains a vulnerability in FOBS, where an attacker may cause deserialization of untrusted data by sending a malicious FOBS- encoded message. A successful exploit of this…
• CVE-2026-24204, published 2026-04-28. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. NVIDIA Flare SDK contains a vulnerability where an Attacker may cause an Improper Input Validation by path traversing. A successful exploit of this vulnerability may lead to information disclosure.