- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 14
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
14 assets you may test, 6 excluded.
Web 1
- https://developer.nvidia.com/triton-inference-server
Products and areas 13
- Ensembles and business logic scripting, which chain models and pass tensors between them
- Every backend the server ships: TensorRT, ONNX Runtime, PyTorch, TensorFlow, OpenVINO, Python, DALI, FIL and the vLLM backend
- Model configuration parsing, covering config.pbtxt, the auto-complete path and the model warmup configuration
- NVIDIA accepts reports through PSIRT and through its Intigriti vulnerability disclosure programme, whose scope is all NVIDIA assets and which states it operates without bounties. Nothing narrower than the Triton server is carved out
- Request and tensor parsing in full, including the binary tensor extension, the raw content payloads and the shape and datatype validation in front of them
- The client libraries and the Performance Analyzer and Model Analyzer tools the project ships
- The HTTP and REST endpoints, the gRPC service and the KServe v2 inference protocol implementation on both
- The metrics, health, statistics and tracing endpoints and what each exposes about loaded models
- The model repository, repository polling, and the model control API that loads and unloads models at runtime
- The Python backend specifically, its stub process model and the boundary between model-supplied code and the server process
- The repository agent API and the cloud storage fetchers for S3, GCS and Azure, including checksum verification
- The sequence batcher, the dynamic batcher and any state carried across requests on behalf of a client
- The shared memory and CUDA shared memory input paths, where a client names a region the server maps and reads
Out of scope (6)
- A server deliberately exposed to an untrusted network with the model control API open
- CUDA, the GPU driver and the device firmware, all of which have their own NVIDIA advisory stream
- Model output content, hallucination and prompt-level behaviour, none of which are software defects in the server
- NVIDIA's own cloud services and NGC infrastructure
- PyTorch, TensorFlow, ONNX Runtime and other frameworks as upstream projects, unless Triton's backend integration is what makes the defect reachable
- The models and weights themselves, whose provenance is the operator's choice
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Report through the NVIDIA product security vulnerability form, which reaches PSIRT, or through the NVIDIA vulnerability disclosure programme on Intigriti
-
Name the backend the finding runs through. TensorRT, ONNX Runtime, PyTorch, TensorFlow, OpenVINO, DALI, FIL and Python are separate implementations with separate parsing code
-
Say whether the model control API was enabled and in which mode. A server that loads models on request is a fundamentally different target from one with a fixed repository
-
Hold detail until the bulletin is public.
Not accepted
-
Model output content, hallucination and prompt-level behaviour, none of which are software defects in the server
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 36 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-65178 | NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted model_config.yaml can inject unsafe parameters. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure. | High 7.8 | 22 Sep 2026 |
| CVE-2026-65179 | NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untrusted, attacker-controlled .pkl file via pickle.load() without validation. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure. | High 8.8 | 22 Sep 2026 |
| CVE-2026-65121 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an improper authentication issue. A successful exploit of this vulnerability might lead to escalation of privileges, information disclosure, and data tampering. | High 8.2 | 22 Sep 2026 |
| CVE-2026-65124 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an XML injection. A successful exploit of this vulnerability might lead to data tampering and denial of service. | Medium 5.9 | 22 Sep 2026 |
| CVE-2026-65125 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a file name or path. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and denial of service. | Medium 6.6 | 22 Sep 2026 |
| CVE-2026-65126 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper enforcement of a behavioral workflow. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure. | Medium 5.0 | 22 Sep 2026 |
| CVE-2026-65127 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause exposure of sensitive system information due to uncleared debug information. A successful exploit of this vulnerability might lead to information disclosure. | Medium 4.1 | 22 Sep 2026 |
| CVE-2026-65128 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQL injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure. | High 8.8 | 22 Sep 2026 |
| CVE-2026-65129 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service. | Medium 6.7 | 22 Sep 2026 |
| CVE-2026-65130 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure. | High 8.0 | 22 Sep 2026 |
| CVE-2026-65113 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of hard-coded credentials. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, denial of service, and information disclosure. | Critical 9.8 | 22 Sep 2026 |
| CVE-2026-65114 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause missing authentication for a critical function. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure. | High 8.3 | 22 Sep 2026 |
| CVE-2026-65115 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker may cause uncontrolled resource consumption. A successful exploit of this vulnerability may lead to denial of service. | Medium 6.5 | 22 Sep 2026 |
| CVE-2026-65117 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of a hard-coded password. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure. | Medium 5.0 | 22 Sep 2026 |
| CVE-2026-65118 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service. | High 7.5 | 22 Sep 2026 |
| CVE-2026-65111 | NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious input created by an attacker could cause a code injection. A successful exploit of this vulnerability might lead to code execution, information disclosure, and data tampering. | High 7.8 | 22 Sep 2026 |
| CVE-2026-65112 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause uncontrolled resource consumption. A successful exploit of this vulnerability might lead to denial of service. | Medium 6.5 | 22 Sep 2026 |
| CVE-2026-24239 | NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious data created by an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, information disclosure, and data tampering. | High 7.8 | 22 Sep 2026 |
| CVE-2026-24267 | NVIDIA NeMo Speech for all platforms contains a vulnerability in the speech data explorer component, where malicious data created by an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering. | High 7.8 | 22 Sep 2026 |
| CVE-2026-61776 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61777 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61778 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61779 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61775 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61772 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61773 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61774 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61764 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61765 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61766 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61767 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61768 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61769 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61770 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61771 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61756 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61757 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61758 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61759 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61760 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61761 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61762 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61763 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61750 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61751 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61752 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61753 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61754 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-61755 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 7.8 | 1 Sep 2026 |
| CVE-2026-65097 | NVIDIA NemoClaw for Linux contains a vulnerability in its installation scripts, where an attacker could cause a download of code without integrity check. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering. | High 7.5 | 25 Aug 2026 |
| CVE-2026-65098 | NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an attacker could cause weak authentication. A successful exploit of this vulnerability might lead to code execution, information disclosure, and data tampering. | High 8.1 | 25 Aug 2026 |
| CVE-2026-65099 | NVIDIA NemoClaw for Linux contains a vulnerability in its command-line interface, where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service. | High 7.8 | 25 Aug 2026 |
| CVE-2026-65105 | NVIDIA NemoClaw for Linux contains a vulnerability in its inference server setup, where a remote attacker may access the inference service without authentication. A successful exploit of this vulnerability may lead to information disclosure and denial of service. | High 8.1 | 25 Aug 2026 |
| CVE-2026-65088 | NVIDIA NemoClaw contains a vulnerability where an attacker could cause invocation of process using visible sensitive information. A successful exploit of this vulnerability might lead to information disclosure. | Medium 5.5 | 25 Aug 2026 |
| CVE-2026-65089 | NVIDIA NemoClaw for Linux contains a vulnerability in its status and logs plugin commands, where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service. | High 7.8 | 25 Aug 2026 |
| CVE-2026-65090 | NVIDIA NemoClaw for Linux contains a vulnerability in its NIM management component, where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service. | High 7.8 | 25 Aug 2026 |
| CVE-2026-65091 | NVIDIA OpenShell for all platforms contains a vulnerability where a malicious gateway could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | High 8.8 | 25 Aug 2026 |
| CVE-2026-65092 | NVIDIA OpenShell Sandbox for Linux contains a vulnerability where an attacker could cause a path traversal bypass of L7 REST network policy. A successful exploit of this vulnerability might lead to information disclosure and data tampering. | High 8.5 | 25 Aug 2026 |
| CVE-2026-65093 | NVIDIA OpenShell for Linux contains a vulnerability where an attacker could cause a sandbox escape. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure. | Critical 9.9 | 25 Aug 2026 |
| CVE-2026-65096 | NVIDIA NemoClaw for Linux contains a vulnerability in the Telegram bridge component, where an attacker could cause an OS command injection. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering. | High 7.8 | 25 Aug 2026 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 50 Last 12 months 58 Lifetime Memory safety 40 % Remote code execution 25 % Path traversal 20 % Info disclosure 15 % Latest advisories Loading the feed Overview Triton is NVIDIA's inference server, the component that actually serves models in production on GPU fleets across cloud, data centre and edge, and it ships inside NVIDIA AI Enterprise. It exposes HTTP and gRPC endpoints accepting binary tensor input and, in many deployments, model files as well, so it sits between untrusted request traffic and expensive hardware holding proprietary weights. NVIDIA runs coordinated disclosure through PSIRT and an Intigriti programme described as responsible disclosure without bounties, both of which recognise reporters on an acknowledgement page and pay nothing. sorona.xyz pays you directly on qualified, reproduced findings. In scope NVIDIA accepts reports through PSIRT and through its Intigriti vulnerability disclosure programme, whose scope is all NVIDIA assets and which states it operates without bounties. Nothing narrower than the Triton server is carved out The HTTP and REST endpoints, the gRPC service and the KServe v2 inference protocol implementation on both Request and tensor parsing in full, including the binary tensor extension, the raw content payloads and the shape and datatype validation in front of them The shared memory and CUDA shared memory input paths, where a client names a region the server maps and reads The model repository, repository polling, and the model control API that loads and unloads models at runtime Every backend the server ships: TensorRT, ONNX Runtime, PyTorch, TensorFlow, OpenVINO, Python, DALI, FIL and the vLLM backend The Python backend specifically, its stub process model and the boundary between model-supplied code and the server process Model configuration parsing, covering config.pbtxt , the auto-complete path and the model warmup configuration Ensembles and business logic scripting, which chain models and pass tensors between them The sequence batcher, the dynamic batcher and any state carried across requests on behalf of a client The repository agent API and the cloud storage fetchers for S3, GCS and Azure, including checksum verification The metrics, health, statistics and tracing endpoints and what each exposes about loaded models The client libraries and the Performance Analyzer and Model Analyzer tools the project ships Out of scope The models and weights themselves, whose provenance is the operator's choice CUDA, the GPU driver and the device firmware, all of which have their own NVIDIA advisory stream PyTorch, TensorFlow, ONNX Runtime and other frameworks as upstream projects, unless Triton's backend integration is what makes the defect reachable A server deliberately exposed to an untrusted network with the model control API open NVIDIA's own cloud services and NGC infrastructure Model output content, hallucination and prompt-level behaviour, none of which are software defects in the server Most-valued findings Memory corruption in request and tensor parsing, since the inference endpoints accept binary input from whatever can reach the port and this is where the existing external research has landed The shared memory and CUDA shared memory paths, where a client names a region and the server maps it, a direct route from request data to process memory The model control API, since loading a model from an attacker-influenced repository is code execution by design once the Python backend is in play Model configuration parsing, because config.pbtxt is read from the repository before any model runs and drives the batching and backend selection that follows Path traversal in the model repository, the repository agent and the cloud storage fetchers, which decide what file the server opens Anything crossing the Python backend's stub process boundary into the server process, which is the isolation the design depends on Ensemble and business logic scripting, which chain untrusted input across models and carry tensors between backends Unauthenticated endpoints exposing model names, configuration, statistics or metrics that reveal proprietary architecture CVE-2025-23310, CVE-2025-23311 and CVE-2025-23268 are the entries the study records, credited to Trail of Bits and the Zero Day Initiative. It describes none of them, so treat the published record as thin rather than as a map Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report through the NVIDIA product security vulnerability form, which reaches PSIRT, or through the NVIDIA vulnerability disclosure programme on Intigriti The Intigriti programme is labelled a responsible disclosure program without bounties and its scope is all NVIDIA assets, which covers Triton. Nothing is paid at any severity PSIRT recognition is a listing on the NVIDIA acknowledgement page with the reporter's agreement. That is the whole reward huntr covers NVIDIA model formats under its model file programme. It does not cover the Triton server, so filing there creates no path Name the backend the finding runs through. TensorRT, ONNX Runtime, PyTorch, TensorFlow, OpenVINO, DALI, FIL and Python are separate implementations with separate parsing code Say whether the model control API was enabled and in which mode. A server that loads models on request is a fundamentally different target from one with a fixed repository Disclosure Coordinated through NVIDIA PSIRT, which publishes security bulletins crediting external researchers alongside a patched container release. Triton ships as versioned NGC containers and inside NVIDIA AI Enterprise, so the coordination runs to those releases rather than to a day count you choose. Hold detail until the bulletin is public. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability