dbnd-airflow (>=0.24.14, <=0.25.15), dbnd-airflow-versioned-dag (>=0.24.14, <=0.25.15) +2 more potentially affected by CVE-2026-40690 via apache-airflow (1.10.7)

apache-airflow PYPI version 1.10.7 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dbnd-airflow =0.24.14, =0.24.14, =0.24.14, =0.24.14, =0.25.7 Source cves: CVE-2026-40690 Source advisory: OSV:PYSEC-2026-2356...

dbnd-airflow (>=0.24.14, <=0.25.15), dbnd-airflow-versioned-dag (>=0.24.14, <=0.25.15) +2 more potentially affected by CVE-2025-54550 via apache-airflow (1.10.7)

apache-airflow PYPI version 1.10.7 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dbnd-airflow =0.24.14, =0.24.14, =0.24.14, =0.24.14, =0.25.7 Source cves: CVE-2025-54550 Source advisory: OSV:PYSEC-2026-2353...

dbnd-airflow (>=0.24.14, <=0.25.15), dbnd-airflow-versioned-dag (>=0.24.14, <=0.25.15) +2 more potentially affected by CVE-2026-25219 via apache-airflow (1.10.7)

apache-airflow PYPI version 1.10.7 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dbnd-airflow =0.24.14, =0.24.14, =0.24.14, =0.24.14, =0.25.7 Source cves: CVE-2026-25219 Source advisory: OSV:PYSEC-2026-2344...

autonomize-model-sdk (1.0.4), databricks-genai (>=1.0.8, <=1.0.13) +1 more potentially affected by CVE-2025-15381 via mlflow (2.14.2)

mlflow PYPI version 2.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autonomize-model-sdk 1.0.4 - databricks-genai =1.0.8, =1.0.33, =1.0.37 Source cves: CVE-2025-15381 Source advisory: OSV:PYSEC-2026-2657...

databricks-genai (>=1.1.8, <=1.2.0a22), sports-prediction-framework (>=0.1.0, <=0.1.4) potentially affected by CVE-2025-15381 via mlflow (2.20.2)

mlflow PYPI version 2.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.1.8, =0.1.0, =0.1.4 Source cves: CVE-2025-15381 Source advisory: OSV:PYSEC-2026-2657...

databricks-genai (1.0.7) potentially affected by CVE-2025-15381 via mlflow (2.11.0)

mlflow PYPI version 2.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai 1.0.7 Source cves: CVE-2025-15381 Source advisory: OSV:PYSEC-2026-2657...

databricks-session (0.1.11) potentially affected by CVE-2025-15381 via mlflow (2.3.0)

mlflow PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-session 0.1.11 Source cves: CVE-2025-15381 Source advisory: OSV:PYSEC-2026-2657...

databricks-session (>=0.0.1, <=0.1.8), geochemistrypi (>=0.7.0, <=0.8.2) +1 more potentially affected by CVE-2025-15381 via mlflow (2.4.1)

mlflow PYPI version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-session =0.0.1, =0.7.0, =0.3.0, =0.3.3 Source cves: CVE-2025-15381 Source advisory: OSV:PYSEC-2026-2657...

databricks-genai (>=1.1.0, <=2.0.0a9), llm-foundry (>=0.12.0, <=0.14.5) +5 more potentially affected by CVE-2025-15381 via mlflow (2.16.2)

mlflow PYPI version 2.16.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.1.0, =0.12.0, =0.0.3.post33, =0.0.16, =0.9.35rc0, =0.8.7, =0.8.8 Source cves: CVE-2025-15381 Source advisory: OSV:PYSEC-2026-26...

databricks-genai (>=1.2.0a0, <=1.2.0a6), deeptrees (>=1.6.0, <=1.8.2) +1 more potentially affected by CVE-2025-15381 via mlflow (2.18.0)

mlflow PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.2.0a0, =1.6.0, =0.15.1, =0.18.0 Source cves: CVE-2025-15381 Source advisory: OSV:PYSEC-2026-2657...

Apache Airflow Provider for Databricks: TLS Certificate Verification is Disabled in Databricks Provider K8s Token Exchange

Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipulated or credentials exfiltrated w/o...

PYSEC-2026-2357 Apache Airflow Provider for Databricks: TLS Certificate Verification is Disabled in Databricks Provider K8s Token Exchange

Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipulated or credentials exfiltrated w/o...

databricks-session (>=0.0.1, <=0.1.8), geochemistrypi (>=0.7.0, <=0.8.2) +1 more potentially affected by CVE-2025-15031 via mlflow (2.4.1)

mlflow PYPI version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-session =0.0.1, =0.7.0, =0.3.0, =0.3.3 Source cves: CVE-2025-15031 Source advisory: OSV:PYSEC-2026-2656...

databricks-genai (>=1.1.8, <=1.2.0a22), sports-prediction-framework (>=0.1.0, <=0.1.4) potentially affected by CVE-2025-15031 via mlflow (2.20.2)

mlflow PYPI version 2.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.1.8, =0.1.0, =0.1.4 Source cves: CVE-2025-15031 Source advisory: OSV:PYSEC-2026-2656...

databricks-genai (>=1.2.0a0, <=1.2.0a6), deeptrees (>=1.6.0, <=1.8.2) +1 more potentially affected by CVE-2025-15031 via mlflow (2.18.0)

mlflow PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.2.0a0, =1.6.0, =0.15.1, =0.18.0 Source cves: CVE-2025-15031 Source advisory: OSV:PYSEC-2026-2656...

auto-mlflow (1.5.0), databricks-genai (>=1.2.0a23, <=1.2.0a24) +2 more potentially affected by CVE-2025-15031 via mlflow (2.20.3)

mlflow PYPI version 2.20.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - auto-mlflow 1.5.0 - databricks-genai =1.2.0a23, =0.1.0, =0.99.9, =0.99.9.post1 Source cves: CVE-2025-15031 Source advisory: OSV:PYSEC-2026-2656...

databricks-genai (1.0.7) potentially affected by CVE-2025-15031 via mlflow (2.11.0)

mlflow PYPI version 2.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai 1.0.7 Source cves: CVE-2025-15031 Source advisory: OSV:PYSEC-2026-2656...

autonomize-model-sdk (1.0.4), databricks-genai (>=1.0.8, <=1.0.13) +1 more potentially affected by CVE-2025-15031 via mlflow (2.14.2)

mlflow PYPI version 2.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autonomize-model-sdk 1.0.4 - databricks-genai =1.0.8, =1.0.33, =1.0.37 Source cves: CVE-2025-15031 Source advisory: OSV:PYSEC-2026-2656...

databricks-session (0.1.11) potentially affected by CVE-2025-15031 via mlflow (2.3.0)

mlflow PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-session 0.1.11 Source cves: CVE-2025-15031 Source advisory: OSV:PYSEC-2026-2656...

databricks-session (0.1.11) potentially affected by CVE-2025-14287 via mlflow (2.3.0)

mlflow PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-session 0.1.11 Source cves: CVE-2025-14287 Source advisory: OSV:PYSEC-2026-2661...