agentos (>=0.0.5, <=0.0.7) potentially affected by CVE-2025-1474 via mlflow (1.9.1)

mlflow PYPI version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - agentos =0.0.5, =0.0.7 Source cves: CVE-2025-1474 Source advisory: OSV:PYSEC-2025-17...

autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2025-1474 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2025-1474 Source advisory: OSV:PYSEC-2025-17...

insurautoml (>=0.2.2.10, <=0.2.3), ntcore (>=0.0.1, <=0.0.3) +2 more potentially affected by CVE-2025-1474 via mlflow (1.21.0)

mlflow PYPI version 1.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - insurautoml =0.2.2.10, =0.0.1, =3.0.0, =2.6.3, =2.6.4 Source cves: CVE-2025-1474 Source advisory: OSV:PYSEC-2025-17...

openstef (>=3.2.0a0, <=3.2.6) potentially affected by CVE-2025-1474 via mlflow (1.25.1)

mlflow PYPI version 1.25.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - openstef =3.2.0a0, =3.2.6 Source cves: CVE-2025-1474 Source advisory: OSV:PYSEC-2025-17...

sapsan (>=0.6.1, <=0.6.2) potentially affected by CVE-2025-1474 via mlflow (1.25.0)

mlflow PYPI version 1.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - sapsan =0.6.1, =0.6.2 Source cves: CVE-2025-1474 Source advisory: OSV:PYSEC-2025-17...

flown (>=0.0.1, <=0.1.0) potentially affected by CVE-2025-1474 via mlflow (1.17.0)

mlflow PYPI version 1.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - flown =0.0.1, =0.1.0 Source cves: CVE-2025-1474 Source advisory: OSV:PYSEC-2025-17...

iqradre (>=0.1.5, <=0.2.1) potentially affected by CVE-2025-1474 via mlflow (1.20.0)

mlflow PYPI version 1.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - iqradre =0.1.5, =0.2.1 Source cves: CVE-2025-1474 Source advisory: OSV:PYSEC-2025-17...

azureml-contrib-run (>=1.0.23, <=1.0.30.1) potentially affected by CVE-2025-1474 via mlflow (0.9.0)

mlflow PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.23, =1.0.30.1 Source cves: CVE-2025-1474 Source advisory: OSV:PYSEC-2025-17...

CVE-2025-0453

In mlflow/mlflow version 2.17.2, the /graphql endpoint is vulnerable to a denial of service attack. An attacker can create large batches of queries that repeatedly request all runs from a given experiment. This can tie up all the workers allocated by MLFlow, rendering the application unable to...

CVE-2025-1473

A Cross-Site Request Forgery CSRF vulnerability exists in the Signup feature of mlflow/mlflow versions 2.17.0 to 2.20.1. This vulnerability allows an attacker to create a new account, which may be used to perform unauthorized actions on behalf of the malicious user...

CVE-2024-8859

A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. When users configure and use the dbfs service, concatenating the URL directly into the file protocol results in an arbitrary file read vulnerability. This issue occurs because only the path part of the URL is checked, while...

CVE-2024-6838

In mlflow/mlflow version v2.13.2, a vulnerability exists that allows the creation or renaming of an experiment with a large number of integers in its name due to the lack of a limit on the experiment name. This can cause the MLflow UI panel to become unresponsive, leading to a potential denial of...

flexibletl (0.1.0), foundry-db (>=0.1.0, <=0.1.30) +29 more potentially affected by CVE-2024-12215 via kedro (>=0.18.14, <=0.19.15)

kedro PYPI version =0.18.14, =0.1.0, =0.1.9, =0.1.0, =0.0.4, =0.1.0, =0.1.0, =0.0.1b1, =1.0.0, =0.2.1, =0.1.2, =0.7.1, =0.12.2, =0.2.0, =0.2.3 and more Source cves: CVE-2024-12215 Source advisory: MEND:CVE-2024-12215...

CVE-2025-0453 Denial of Service through Batched Queries in GraphQL in mlflow/mlflow

In mlflow/mlflow version 2.17.2, the /graphql endpoint is vulnerable to a denial of service attack. An attacker can create large batches of queries that repeatedly request all runs from a given experiment. This can tie up all the workers allocated by MLFlow, rendering the application unable to...

CVE-2025-0453

In mlflow/mlflow version 2.17.2, the "/graphql" endpoint is vulnerable to a denial of service attack. An attacker can create large batches of queries that repeatedly request all runs from a given experiment. This can tie up all the workers allocated by MLFlow, rendering the application unable to...

CVE-2025-0453

CVE-2025-0453 : In mlflow/mlflow version 2.17.2, the /graphql endpoint is vulnerable to denial of service via large batches of queries that repeatedly request all runs from a given experiment, causing uncontrolled resource consumption and making the application unresponsive. The issue is document...

CVE-2025-0453 Denial of Service through Batched Queries in GraphQL in mlflow/mlflow

In mlflow/mlflow version 2.17.2, the /graphql endpoint is vulnerable to a denial of service attack. An attacker can create large batches of queries that repeatedly request all runs from a given experiment. This can tie up all the workers allocated by MLFlow, rendering the application unable to...

CVE-2025-0453 Denial of Service through Batched Queries in GraphQL in mlflow/mlflow

In mlflow/mlflow version 2.17.2, the /graphql endpoint is vulnerable to a denial of service attack. An attacker can create large batches of queries that repeatedly request all runs from a given experiment. This can tie up all the workers allocated by MLFlow, rendering the application unable to...

CVE-2025-1474 Weak Password Requirements in mlflow/mlflow

In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user accou...

CVE-2025-1474 Weak Password Requirements in mlflow/mlflow

In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user accou...