databricks-session (>=0.0.1, <=0.1.8), geochemistrypi (>=0.7.0, <=0.8.2) +1 more potentially affected by CVE-2025-14279 via mlflow (2.4.1)

mlflow PYPI version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-session =0.0.1, =0.7.0, =0.3.0, =0.3.3 Source cves: CVE-2025-14279 Source advisory: OSV:GHSA-PGQP-8H46-6X4J...

azureml-evaluate-mlflow (>=0.0.46, <=47.0.0), cogflow (>=1.2.0, <=1.2.13) +5 more potentially affected by CVE-2025-14279 via mlflow (2.10.2)

mlflow PYPI version 2.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-evaluate-mlflow =0.0.46, =1.2.0, =0.0.10, =1.2.7, =1.0.0, =0.1.0, =0.1.1 Source cves: CVE-2025-14279 Source advisory: OSV:GHSA-PGQP-8H46-6X...

databricks-genai (1.0.7) potentially affected by CVE-2025-14279 via mlflow (2.11.0)

mlflow PYPI version 2.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai 1.0.7 Source cves: CVE-2025-14279 Source advisory: OSV:GHSA-PGQP-8H46-6X4J...

autonomize-model-sdk (1.0.4), databricks-genai (>=1.0.8, <=1.0.13) +1 more potentially affected by CVE-2025-14279 via mlflow (2.14.2)

mlflow PYPI version 2.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autonomize-model-sdk 1.0.4 - databricks-genai =1.0.8, =1.0.33, =1.0.37 Source cves: CVE-2025-14279 Source advisory: OSV:GHSA-PGQP-8H46-6X4J...

databricks-genai (>=1.1.0, <=2.0.0a9), llm-foundry (>=0.12.0, <=0.14.5) +5 more potentially affected by CVE-2025-14279 via mlflow (2.16.2)

mlflow PYPI version 2.16.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.1.0, =0.12.0, =0.0.3.post33, =0.0.16, =0.9.35rc0, =0.8.7, =0.8.8 Source cves: CVE-2025-14279 Source advisory:...

databricks-genai (>=1.2.0a0, <=1.2.0a6), deeptrees (>=1.6.0, <=1.8.2) +1 more potentially affected by CVE-2025-14279 via mlflow (2.18.0)

mlflow PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.2.0a0, =1.6.0, =0.15.1, =0.18.0 Source cves: CVE-2025-14279 Source advisory: OSV:GHSA-PGQP-8H46-6X4J...

databricks-genai (>=1.1.8, <=1.2.0a22), sports-prediction-framework (>=0.1.0, <=0.1.4) potentially affected by CVE-2025-14279 via mlflow (2.20.2)

mlflow PYPI version 2.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.1.8, =0.1.0, =0.1.4 Source cves: CVE-2025-14279 Source advisory: OSV:GHSA-PGQP-8H46-6X4J...

auto-mlflow (1.5.0), databricks-genai (>=1.2.0a23, <=1.2.0a24) +2 more potentially affected by CVE-2025-14279 via mlflow (2.20.3)

mlflow PYPI version 2.20.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - auto-mlflow 1.5.0 - databricks-genai =1.2.0a23, =0.1.0, =0.99.9, =0.99.9.post1 Source cves: CVE-2025-14279 Source advisory: OSV:GHSA-PGQP-8H46-6X4J...

Grafana Databricks Data Source Plugin Information Disclosure

The vulnerability of the data source plugin for open-source platforms for monitoring and observation by Grafana Databricks is related to insufficient spatial partitioning. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...

Grafana Databricks Data Source Plugin Information Disclosure

The vulnerability of the data source plugin for open-source platforms for monitoring and observation by Grafana Databricks is related to insufficient spatial partitioning. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...

Databricks: undisclosed vulnerability (ZAI-2026-BVF26F)

Not disclosed. Details are not yet publicly disclosed...

dbnd-airflow (>=0.24.14, <=0.25.15), dbnd-airflow-versioned-dag (>=0.24.14, <=0.25.15) +2 more potentially affected by CVE-2025-67895 via apache-airflow (1.10.7)

apache-airflow PYPI version 1.10.7 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dbnd-airflow =0.24.14, =0.24.14, =0.24.14, =0.24.14, =0.25.7 Source cves: CVE-2025-67895 Source advisory: OSV:PYSEC-2025-87...

com.databricks:databricks-jdbc-thin (>=3.3.1, <=3.3.3), com.github.pjfanning:pekko-serialization-jackson3_2.12 (1.1.0) +50 more potentially affected by CVE-2025-66566 via at.yawk.lz4:lz4-java (>=1.8.1, <=1.10.0)

at.yawk.lz4:lz4-java MAVEN version =1.8.1, =3.3.1, =3.9.0-rc5-p11, =3.10.1-dev-p17 - io.gitee.jiujiupin:fxu-framework 3.0.0 - io.gitee.jiujiupin:fxu-generator 1.3.2 - io.telicent.jena:jena-fuseki-kafka-module 2.3.1 - io.telicent.jena:jena-kafka-connector 2.3.1 -...

Malicious code in @posthog/databricks-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e391efe36d6c40d46f8c9abbf9d68a3b7b73a56319db5a85a486fedfe90cb394 The package @posthog/databricks-plugin was found to contain malicious code. Source: google-open-source-security...

MAL-2025-190876 Malicious code in @posthog/databricks-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e391efe36d6c40d46f8c9abbf9d68a3b7b73a56319db5a85a486fedfe90cb394 The package @posthog/databricks-plugin was found to contain malicious code. Source: google-open-source-security...

EUVD-2025-198949

Malicious code in @posthog/databricks-plugin npm...

CVE-2025-41116

When using the Grafana Databricks Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in the wrong user identifier being used, and information for which the viewer is...

com.databricks:automatedml_2.11 (0.7.2), com.github.aishfenton:vegas-flink_2.11 (0.3.4) +11 more potentially affected by CVE-2025-59840 via org.webjars.bower:vega (>=1.5.4, <=3.0.0-rc4)

org.webjars.bower:vega MAVEN version =1.5.4, =0.3.6, =0.3.6, =0.3.6, =1.1.0, =2.1.0, =1.0.10, =2.0.1 Source cves: CVE-2025-59840 Source advisory: SNYK:JAVA-ORGWEBJARSBOWER-13961288...

CVE-2025-41116

When using the Grafana Databricks Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in the wrong user identifier being used, and information for which the viewer is...

CVE-2025-41116 Incorrect oauth passthrough in Grafana Databricks Datasource

When using the Grafana Databricks Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in the wrong user identifier being used, and information for which the viewer is...