autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2023-6014 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2023-6014 Source advisory: OSV:PYSEC-2026-415...

autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2023-6018 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2023-6018 Source advisory: OSV:PYSEC-2026-417...

XXE Vulnerability in MerlinReader

Impact MPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file...

autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2026-10803 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2026-10803 Source advisory: OSV:GHSA-5QMP-P3C4-72QJ...

autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2026-10803 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2026-10803 Source advisory: OSV:PYSEC-2026-195...

autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2026-4035 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2026-4035 Source advisory: OSV:GHSA-G35P-PX32-WHV6...

azureml-evaluate-mlflow (>=0.0.57, <=0.0.58), eensight (>=1.0.0, <=1.0.2) +6 more potentially affected by CVE-2026-4035 via mlflow (2.12.2)

mlflow PYPI version 2.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-evaluate-mlflow =0.0.57, =1.0.0, =0.8.0, =0.0.6, =0.6.0.dev0, =0.10.0, =0.10.2 Source cves: CVE-2026-4035 Source advisory:...

autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2026-4035 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2026-4035 Source advisory: OSV:PYSEC-2026-2222...

autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2026-3198 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2026-3198 Source advisory: OSV:GHSA-R5M9-WM49-959F...

autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2026-2651 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2026-2651 Source advisory: OSV:GHSA-8C7Q-86FQ-VVMH...

Security Bulletin: NVIDIA Merlin - May 2026

NVIDIA has released a software update for NVIDIA® Merlin. To protect your system, clone or update this software to include any commit after March 11, 2026 from the NVIDIA-Merlin/Transformers4Rec GitHub repo. Go to NVIDIA Product Security. Details The following table summarizes the potential...

autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2026-2651 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2026-2651 Source advisory: OSV:PYSEC-2026-2220...

autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2026-2734 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2026-2734 Source advisory: OSV:GHSA-W5XQ-C4PF-GHQ7...

autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2026-2652 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2026-2652 Source advisory: OSV:GHSA-75CM-X2W3-8MGF...

autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2026-2652 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2026-2652 Source advisory: OSV:PYSEC-2026-2221...

autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2026-2614 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2026-2614 Source advisory: OSV:GHSA-42H5-H8QH-VV9V...

azureml-evaluate-mlflow (>=0.0.57, <=0.0.58), eensight (>=1.0.0, <=1.0.2) +6 more potentially affected by CVE-2026-2614 via mlflow (2.12.2)

mlflow PYPI version 2.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-evaluate-mlflow =0.0.57, =1.0.0, =0.8.0, =0.0.6, =0.6.0.dev0, =0.10.0, =0.10.2 Source cves: CVE-2026-2614 Source advisory:...

autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2026-2393 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2026-2393 Source advisory: OSV:GHSA-65H7-C7C4-MGHX...

autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2026-33866 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2026-33866 Source advisory: OSV:GHSA-46R5-X6JQ-V8G6...

autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2026-33865 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2026-33865 Source advisory: OSV:GHSA-FH64-R2VC-XVHR...