auto-mlflow (1.5.0), databricks-genai (>=1.2.0a23, <=1.2.0a24) +2 more potentially affected by CVE-2026-0596 via mlflow (2.20.3)

mlflow PYPI version 2.20.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - auto-mlflow 1.5.0 - databricks-genai =1.2.0a23, =0.1.0, =0.99.9, =0.99.9.post1 Source cves: CVE-2026-0596 Source advisory: OSV:PYSEC-2026-424...

dbnd-airflow (>=0.24.14, <=0.25.15), dbnd-airflow-versioned-dag (>=0.24.14, <=0.25.15) +2 more potentially affected by CVE-2023-22884 via apache-airflow (1.10.7)

apache-airflow PYPI version 1.10.7 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dbnd-airflow =0.24.14, =0.24.14, =0.24.14, =0.24.14, =0.25.7 Source cves: CVE-2023-22884 Source advisory: OSV:PYSEC-2026-268...

dbnd-airflow (>=0.24.14, <=0.25.15), dbnd-airflow-versioned-dag (>=0.24.14, <=0.25.15) +2 more potentially affected by CVE-2022-38649 via apache-airflow (1.10.7)

apache-airflow PYPI version 1.10.7 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dbnd-airflow =0.24.14, =0.24.14, =0.24.14, =0.24.14, =0.25.7 Source cves: CVE-2022-38649 Source advisory: OSV:PYSEC-2026-267...

dbnd-airflow (>=0.24.14, <=0.25.15), dbnd-airflow-versioned-dag (>=0.24.14, <=0.25.15) +2 more potentially affected by CVE-2022-40189 via apache-airflow (1.10.7)

apache-airflow PYPI version 1.10.7 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dbnd-airflow =0.24.14, =0.24.14, =0.24.14, =0.24.14, =0.25.7 Source cves: CVE-2022-40189 Source advisory: OSV:PYSEC-2026-270...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: ksops, crossplane-provider-aws-kafkaconnect-fips, consul-fips, gitea-fips, fscrypt, crossplane-provider-aws-appflow-fips, rancher-machine, argo-cd, gitlab-kas, gptscript, crossplane-provider-aws-cognitoidentity-fips, loki, skaffold-fips,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: ksops, crossplane-provider-aws-kafkaconnect-fips, consul-fips, gitea-fips, fscrypt, crossplane-provider-aws-appflow-fips, rancher-machine, argo-cd, gitlab-kas, gptscript, crossplane-provider-aws-cognitoidentity-fips, loki, skaffold-fips,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: ksops, ucd, cadvisor, terraform-mcp-server, k8ssandra-client-fips, hydra-fips, consul-fips, cert-manager-webhook-pdns-fips, flagger-fips, kserve-localmodelnode-agent-fips, vault-secrets-operator, rancher-machine, argo-cd, gitlab-kas, eks-distro, weaviate,...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: ksops, ucd, cadvisor, terraform-mcp-server, k8ssandra-client-fips, hydra-fips, consul-fips, cert-manager-webhook-pdns-fips, flagger-fips, kserve-localmodelnode-agent-fips, vault-secrets-operator, rancher-machine, argo-cd, gitlab-kas, eks-distro, weaviate,...

Malicious code in databricks-tools-core (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9ecf172545ef84f1fcbeeae028a55d2bb570d68a3356a26526269e267f184a10 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-5809 Malicious code in databricks-tools-core (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9ecf172545ef84f1fcbeeae028a55d2bb570d68a3356a26526269e267f184a10 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

GHSA-W2Q5-6Q6X-X959 vulnerabilities

Vulnerabilities for packages: athenz-csi-driver-fips, cadvisor, karpenter-fips, kubedock, crossplane-provider-aws-cur-fips, hydra-fips, crossplane-provider-aws-apigateway, crossplane-provider-aws-servicecatalog, crossplane-provider-aws-bedrockagentcore, sonobuoy,...

databricks-session (0.1.11) potentially affected by CVE-2026-10803 via mlflow (2.3.0)

mlflow PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-session 0.1.11 Source cves: CVE-2026-10803 Source advisory: OSV:GHSA-5QMP-P3C4-72QJ...

databricks-session (>=0.0.1, <=0.1.8), geochemistrypi (>=0.7.0, <=0.8.2) +1 more potentially affected by CVE-2026-10803 via mlflow (2.4.1)

mlflow PYPI version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-session =0.0.1, =0.7.0, =0.3.0, =0.3.3 Source cves: CVE-2026-10803 Source advisory: OSV:GHSA-5QMP-P3C4-72QJ...

databricks-genai (1.0.7) potentially affected by CVE-2026-10803 via mlflow (2.11.0)

mlflow PYPI version 2.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai 1.0.7 Source cves: CVE-2026-10803 Source advisory: OSV:GHSA-5QMP-P3C4-72QJ...

auto-mlflow (1.5.0), databricks-genai (>=1.2.0a23, <=1.2.0a24) +2 more potentially affected by CVE-2026-10803 via mlflow (2.20.3)

mlflow PYPI version 2.20.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - auto-mlflow 1.5.0 - databricks-genai =1.2.0a23, =0.1.0, =0.99.9, =0.99.9.post1 Source cves: CVE-2026-10803 Source advisory: OSV:GHSA-5QMP-P3C4-72QJ...

databricks-genai (>=1.2.0a0, <=1.2.0a6), deeptrees (>=1.6.0, <=1.8.2) +1 more potentially affected by CVE-2026-10803 via mlflow (2.18.0)

mlflow PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.2.0a0, =1.6.0, =0.15.1, =0.18.0 Source cves: CVE-2026-10803 Source advisory: OSV:GHSA-5QMP-P3C4-72QJ...

databricks-genai (>=1.1.8, <=1.2.0a22), sports-prediction-framework (>=0.1.0, <=0.1.4) potentially affected by CVE-2026-10803 via mlflow (2.20.2)

mlflow PYPI version 2.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.1.8, =0.1.0, =0.1.4 Source cves: CVE-2026-10803 Source advisory: OSV:GHSA-5QMP-P3C4-72QJ...

databricks-genai (>=1.2.0a0, <=1.2.0a6), deeptrees (>=1.6.0, <=1.8.2) +1 more potentially affected by CVE-2026-10803 via mlflow (2.18.0)

mlflow PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.2.0a0, =1.6.0, =0.15.1, =0.18.0 Source cves: CVE-2026-10803 Source advisory: OSV:PYSEC-2026-195...

databricks-genai (>=1.1.0, <=2.0.0a9), llm-foundry (>=0.12.0, <=0.14.5) +5 more potentially affected by CVE-2026-10803 via mlflow (2.16.2)

mlflow PYPI version 2.16.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.1.0, =0.12.0, =0.0.3.post33, =0.0.16, =0.9.35rc0, =0.8.7, =0.8.8 Source cves: CVE-2026-10803 Source advisory: OSV:PYSEC-2026-19...

auto-mlflow (1.5.0), databricks-genai (>=1.2.0a23, <=1.2.0a24) +2 more potentially affected by CVE-2026-10803 via mlflow (2.20.3)

mlflow PYPI version 2.20.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - auto-mlflow 1.5.0 - databricks-genai =1.2.0a23, =0.1.0, =0.99.9, =0.99.9.post1 Source cves: CVE-2026-10803 Source advisory: OSV:PYSEC-2026-195...