| Reporter | Title | Published | Views | Family All 18 |
|---|---|---|---|---|
 | Incomplete Fix for CVE-2025-10279: get_or_create_nfs_tmp_dir() Still Creates World-Writable (0o777) Directories Enabling Local Code Execution | 17 Feb 202620:26 | – | huntr |
 | CVE-2026-4137 | 18 May 202620:26 | – | attackerkb |
 | MLflow 安全漏洞 | 18 May 202600:00 | – | cnnvd |
 | CVE-2026-4137 Incomplete Fix for CVE-2025-10279: Insecure Temporary Directory Permissions in mlflow/mlflow | 18 May 202620:26 | – | cvelist |
 | EUVD-2026-30807 | 18 May 202620:26 | – | euvd |
 | MLFlow Creates a Temporary File With Insecure Permissions | 18 May 202621:31 | – | github |
 | CVE-2026-4137 | 18 May 202621:16 | – | nvd |
 | BIT-MLFLOW-2026-4137 Incomplete Fix for CVE-2025-10279: Insecure Temporary Directory Permissions in mlflow/mlflow | 5 Jun 202605:49 | – | osv |
| CLSA-2026-1780879898 TuxCare security update for 2 packages (1 CVE) | 4 Aug 202614:52 | – | osv |
| CLSA-2026-1787213730 TuxCare security update for mlflow (3 CVEs) | 20 Aug 202608:15 | – | osv |
10
Node
[
{
"vendor": "mlflow",
"product": "mlflow/mlflow",
"versions": [
{
"version": "unspecified",
"lessThan": "3.11.0",
"status": "affected",
"versionType": "custom"
}
]
}
]| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| world-writable permissions (0o777) used for temporary directories created by get_or_create_nfs_tmp_dir() | path | mlflow/utils/file_utils.py:get_or_create_nfs_tmp_dir | Insecure temporary directory creation due to world-writable permissions enabling tampering by local attackers and potential arbitrary code execution during artifact deserialization. | CWE-378 |
| group-writable permissions (0o770) used for model download tmp directories created by _create_model_downloading_tmp_dir() | path | mlflow/pyfunc/__init__.py:_create_model_downloading_tmp_dir | Insecure temporary directory creation due to group-writable permissions enabling tampering by other users on shared systems, risking arbitrary code execution upon deserialization of artifacts. | CWE-378 |
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
24 Jul 2026 12:10Current
7.6High risk
Vulners AI Score7.6
CVSS 3.17.8
CVSS 37
EPSS0.00193
SSVC