Critical Vulnerabilities Disclosed in NVIDIA Dynamo with Remote Attack Risks
NVIDIA has disclosed multiple vulnerabilities in its NVIDIA Dynamo software, a Linux-based solution designed for serving multimodal data. The issues were detailed in a security advisory published on August 4, 2026, affecting various versions with a combined total of 15 CVEs confirmed.
The most critical finding is CVE-2026-24254, an out-of-bounds write vulnerability in the multimodal serving topology. This flaw permits remote attackers to exploit it without authentication, earning a CVSS v3.1 base score of 9.8 and a Critical severity rating. A noted discrepancy exists between the score and the vector string, which may require future correction.
Two additional vulnerabilities follow with CVSS scores of 8.2. CVE-2026-24253 involves out-of-bounds memory writes that could lead to denial of service. CVE-2026-47623 arises from deserializing untrusted data, potentially enabling denial of service or data tampering.
Updated versions addressing these issues are now available from NVIDIA. Organizations using NVIDIA Dynamo should apply the patches promptly to reduce exposure to these remote attack vectors.
Related articles
Veeam ONE Receives Security Update Addressing Critical Vulnerabilities Including CVE-2026-65641
Veeam Software has released updates for its backup environment monitoring tool Veeam ONE to address multiple vulnerabilities. The advisory covers the 13.x series and includes fixes rated as critical under CVSSv4.0. One flaw, CVE-2026-65641, allows service accounts to perform SMB authentication and carries a base score of 9.3. Additional high-severity issues such as CVE-2026-64633 with a perfect 10.0 score were also resolved in the patches. The company updated its disclosure to include seven vulnerabilities fixed in version 13.1.0.7034 after initially reporting six. Patches are now available for both the 13.x and 12.x branches, with the latest 12.3 Patch 1 backporting several fixes from the 13 series.
Three Critical Vulnerabilities in Adobe Campaign Classic Allow Arbitrary Code Execution
Adobe has disclosed three severe vulnerabilities in Adobe Campaign Classic that could permit attackers to execute arbitrary code on affected systems. The issues affect both Windows and Linux versions and include two OS command injection flaws along with one server-side request forgery vulnerability. Each vulnerability received the maximum CVSSv3.1 base score of 10.0 and is rated Critical. Adobe released fixes in version 7.4.4 build 9401, which must be applied to on-premises components in both pure on-premises and hybrid environments. Although no active exploitation has been observed, Adobe assigned the highest priority level and recommends applying the update within 72 hours.
Dirty COW CVE-2016-5195: How a 2016 Linux Kernel Race Condition Still Enables Privilege Escalation in Embedded Systems
The 2016 Linux kernel vulnerability CVE-2016-5195, known as Dirty COW, allowed local users to bypass copy-on-write protections and modify read-only memory mappings through a race condition involving writes to /proc/self/mem and madvise calls. Although patched in supported distributions years ago, the flaw persists in older kernels running on routers, cameras, and industrial controllers that receive infrequent firmware updates. Public exploits often target /etc/passwd or SUID binaries for root access, but success depends heavily on the presence of login mechanisms, BusyBox applets, and suitable binaries in the target environment. When standard targets are absent, attackers may pivot to overwriting vDSO functions in process memory to inject code executed by higher-privileged processes. The article explains why ready-made PoCs frequently fail on minimal BusyBox-based systems and outlines the checks required for architecture, ABI, vDSO symbols, and payload compatibility. It also references the practical exercise Strange And Dirty on the free White Hacker course for hands-on adaptation of the exploit chain.
Critical Authentication Bypass Vulnerability Found in OAuth2 Proxy, No Patch Released
A severe authentication bypass vulnerability has been identified in the OAuth2 Proxy authentication proxy, tracked as CVE-2026-76835. The issue allows attackers to circumvent authentication by sending crafted X-Forwarded-Uri headers when the trusted_proxy_ip setting is not configured. This affects default reverse proxy configurations and enables unauthorized access to protected paths. Although version 7.15.2 addressed a related flaw under CVE-2026-40575, the vulnerability persists in standard reverse proxy setups. VulnCheck rated the flaw with a CVSS v4.0 base score of 9.3, classifying it as Critical. No patched release is currently available despite ongoing work in the source repository.