91 matches found
CVE-2026-56852 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-cloudtrail, amazon-cloudwatch-agent-operator-fips, crossplane-provider-azure-storage, pulumi-kubernetes-operator, crossplane-provider-aws-redshiftserverless-fips, terraform-provider-random, crossplane-provider-aws-s3, redpanda-console,...
GHSA-JPJM-C3R5-Q96R vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-cloudtrail, amazon-cloudwatch-agent-operator-fips, crossplane-provider-azure-storage, pulumi-kubernetes-operator, crossplane-provider-aws-redshiftserverless-fips, terraform-provider-random, crossplane-provider-aws-s3, redpanda-console,...
PYSEC-2026-2655 MLFlow Creates a Temporary File With Insecure Permissions
In mlflow/mlflow versions prior to 3.11.0, the getorcreatenfstmpdir function in mlflow/utils/fileutils.py creates temporary directories with world-writable permissions 0o777, and the createmodeldownloadingtmpdir function in mlflow/pyfunc/init.py creates directories with group-writable permissions...
PYSEC-2026-2357 Apache Airflow Provider for Databricks: TLS Certificate Verification is Disabled in Databricks Provider K8s Token Exchange
Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipulated or credentials exfiltrated w/o...
GHSA-Q4H4-GMJ2-QVW2 vulnerabilities
Vulnerabilities for packages: seaweedfs-rocksdb-fips, crossplane-provider-aws-cloudtrail, crossplane-provider-azure-storage, pulumi-kubernetes-operator, crossplane-provider-aws-redshiftserverless-fips, crossplane-provider-aws-s3, crossplane-aws-provider, redpanda-console, ko-fips,...
GHSA-RM3J-F69W-WQMQ vulnerabilities
Vulnerabilities for packages: seaweedfs-rocksdb-fips, crossplane-provider-aws-cloudtrail, crossplane-provider-azure-storage, pulumi-kubernetes-operator, crossplane-provider-aws-redshiftserverless-fips, crossplane-provider-aws-s3, crossplane-aws-provider, redpanda-console, ko-fips,...
CVE-2026-41178 vulnerabilities
Vulnerabilities for packages: seaweedfs-rocksdb-fips, crossplane-provider-aws-cloudtrail, amazon-cloudwatch-agent-operator-fips, cerbos-fips, crossplane-provider-azure-storage, ingress-nginx-controller-fips, cert-manager-google-cas-issuer-fips, pulumi-kubernetes-operator, ucd,...
GHSA-5WRP-CWCJ-Q835 vulnerabilities
Vulnerabilities for packages: seaweedfs-rocksdb-fips, crossplane-provider-aws-cloudtrail, amazon-cloudwatch-agent-operator-fips, cerbos-fips, crossplane-provider-azure-storage, ingress-nginx-controller-fips, cert-manager-google-cas-issuer-fips, pulumi-kubernetes-operator, ucd,...
Malicious code in databricks-tools-core (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 9ecf172545ef84f1fcbeeae028a55d2bb570d68a3356a26526269e267f184a10 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2026-5809 Malicious code in databricks-tools-core (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 9ecf172545ef84f1fcbeeae028a55d2bb570d68a3356a26526269e267f184a10 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
GHSA-W2Q5-6Q6X-X959 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-cloudtrail, cerbos-fips, terraform-provider-random, crossplane-aws-provider, ghaudit, cert-manager-istio-csr-fips, splunk-otel-collector, prometheus-nats-exporter, external-secrets-operator-fips, secrets-store-csi-driver, ld-relay, thanos-fips...
GHSA-F2M9-WCF4-CWWX MLFlow Creates a Temporary File With Insecure Permissions
In mlflow/mlflow versions prior to 3.11.0, the getorcreatenfstmpdir function in mlflow/utils/fileutils.py creates temporary directories with world-writable permissions 0o777, and the createmodeldownloadingtmpdir function in mlflow/pyfunc/init.py creates directories with group-writable permissions...
EUVD-2026-30807
In mlflow/mlflow versions prior to 3.11.0, the getorcreatenfstmpdir function in mlflow/utils/fileutils.py creates temporary directories with world-writable permissions 0o777, and the createmodeldownloadingtmpdir function in mlflow/pyfunc/init.py creates directories with group-writable permissions...
CVE-2026-4137 Incomplete Fix for CVE-2025-10279: Insecure Temporary Directory Permissions in mlflow/mlflow
In mlflow/mlflow versions prior to 3.11.0, the getorcreatenfstmpdir function in mlflow/utils/fileutils.py creates temporary directories with world-writable permissions 0o777, and the createmodeldownloadingtmpdir function in mlflow/pyfunc/init.py creates directories with group-writable permissions...
CVE-2026-4137
CVE-2026-4137 : In mlflow/mlflow before 3.11.0, two temp-dir creation paths expose world/group-writable permissions: get_or_create_nfs_tmp_dir() creates 0o777 and _create_model_downloading_tmp_dir() creates 0o770. This enables local attackers with access to shared NFS mounts (e.g., Databricks) to...
PT-2026-41733
Name of the Vulnerable Software and Affected Versions mlflow versions prior to 3.11.0 Description The get or create nfs tmp dir function in mlflow/utils/file utils.py creates temporary directories with world-writable permissions 0o777, and the create model downloading tmp dir function in...
📄 Apache Airflow Databricks Provider Certificate Verification Bypass
The Apache Airflow Databricks Provider package disables TLS certificate verification when communicating with the Kubernetes API server during federated token exchange. Both the synchronous and asynchronous code paths use verify=False / ssl=False, allowing any attacker with network access within t...
Wiz and Databricks: Adding Databricks to the Wiz Security Graph
Extending Wiz Visibility with the Databricks Data & AI Platform...
CVE-2026-32283 vulnerabilities
Vulnerabilities for packages: amazon-cloudwatch-agent-operator-fips, crossplane-provider-azure-storage, ingress-nginx-controller-fips, cert-manager-google-cas-issuer-fips, dynamic-localpv-provisioner-fips, terraform-provider-random, ucd, kyverno-policy-reporter-ui, apache-exporter,...
GHSA-GJVH-7JH8-7XHM vulnerabilities
Vulnerabilities for packages: amazon-cloudwatch-agent-operator-fips, crossplane-provider-azure-storage, ingress-nginx-controller-fips, cert-manager-google-cas-issuer-fips, dynamic-localpv-provisioner-fips, terraform-provider-random, ucd, kyverno-policy-reporter-ui, apache-exporter,...