13361 matches found
BIT-MLFLOW-2026-3198 Improper Access Control in mlflow/mlflow
MLflow 3.9.0 with basic-auth --app-name basic-auth fails to enforce authorization checks for multiple Gateway API 'list' endpoints. Specifically, the BEFOREREQUESTHANDLERS dictionary in mlflow/server/auth/init.py does not include entries for ListGatewaySecretInfos, ListGatewayEndpoints, and...
BIT-MLFLOW-2026-2734 Authorization Bypass in SearchModelVersions in mlflow/mlflow
In mlflow/mlflow versions up to 3.9.0, the SearchModelVersions REST API endpoint and the mlflowSearchModelVersions GraphQL query lack proper per-model authorization checks when basic authentication is enabled. This allows any authenticated user to enumerate all model versions across all registere...
MINI-W496-H8X2-R9QR
Bulletin has no description...
Exploit for Missing Authentication for Critical Function in Mcpjam Inspector
CVE-2026-23744-MCPJAM-RCE-exploit This Python proof-of-concept...
MINI-798F-7PX3-9HC6
Bulletin has no description...
MINI-X7QC-X7FQ-PWMV
Bulletin has no description...
MINI-369P-95V3-GH37
Bulletin has no description...
MINI-MQ5C-CPPJ-49G6
Bulletin has no description...
MINI-Q85F-FMJ4-XHMM
Bulletin has no description...
MINI-5P5C-635X-G528
Bulletin has no description...
MINI-4388-V598-299W
Bulletin has no description...
MINI-M5VP-429F-M734
Bulletin has no description...
MINI-F825-CRRC-J7RQ
Bulletin has no description...
MINI-HGH5-394C-XX87
Bulletin has no description...
MINI-P6PR-RG48-H959
Bulletin has no description...
MINI-76PM-9XCM-J52C
Bulletin has no description...
MINI-58MC-R693-MXQV
Bulletin has no description...
MINI-V25P-G6MG-M644
Bulletin has no description...