3416 matches found
azureml-evaluate-mlflow (>=0.0.57, <=0.0.58), eensight (>=1.0.0, <=1.0.2) +6 more potentially affected by CVE-2026-2033 via mlflow (2.12.2)
mlflow PYPI version 2.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-evaluate-mlflow =0.0.57, =1.0.0, =0.8.0, =0.0.6, =0.6.0.dev0, =0.10.0, =0.10.2 Source cves: CVE-2026-2033 Source advisory: OSV:PYSEC-2026-2...
llm-foundry (>=0.9.1, <=0.10.0), mlflow-pytorch-exp (0.0.1) potentially affected by CVE-2026-2033 via mlflow (2.14.3)
mlflow PYPI version 2.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry =0.9.1, =0.10.0 - mlflow-pytorch-exp 0.0.1 Source cves: CVE-2026-2033 Source advisory: OSV:PYSEC-2026-2658...
Arbitrary Command Injection
Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the ssh process. An attacker can execute arbitrary commands on the operator's workstation by injecting malicious OpenSSH options when the operator runs non-interactive SSH commands. Remediation Upgrade...
CVE-2026-47840
A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certificate from any trusted CA, then harvest the LDAP bind password and every end-user password sent during simple-bind authentication, and return forged group memberships that grant themselv...
CVE-2026-25681 affecting package cf-cli for versions less than 8.7.11-7
CVE-2026-25681 affecting package cf-cli for versions less than 8.7.11-7. A patched version of the package is available...
CVE-2026-42502 affecting package cf-cli for versions less than 8.7.11-7
CVE-2026-42502 affecting package cf-cli for versions less than 8.7.11-7. A patched version of the package is available...
CVE-2026-41857 - BOSH CLI Shell Injection | Cloud Foundry
High ● CVSSv4: High 7.1CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N ● CVSSv3: High 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Vendor CloudFoundry BOSH Versions Affected Severity is High unless otherwise noted. BOSH CLI – All versions prior to 7.10.5 inclusive Description ...
llm-foundry (>=0.9.1, <=0.10.0), mlflow-pytorch-exp (0.0.1) potentially affected by CVE-2025-10279 via mlflow (2.14.3)
mlflow PYPI version 2.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry =0.9.1, =0.10.0 - mlflow-pytorch-exp 0.0.1 Source cves: CVE-2025-10279 Source advisory: OSV:PYSEC-2026-1639...
llm-foundry (0.11.0), modeva (>=1.0.14, <=2.1.0) potentially affected by CVE-2025-10279 via mlflow (2.15.1)
mlflow PYPI version 2.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry 0.11.0 - modeva =1.0.14, =2.1.0 Source cves: CVE-2025-10279 Source advisory: OSV:PYSEC-2026-1639...
databricks-genai (>=1.1.0, <=2.0.0a9), llm-foundry (>=0.12.0, <=0.14.5) +5 more potentially affected by CVE-2025-10279 via mlflow (2.16.2)
mlflow PYPI version 2.16.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.1.0, =0.12.0, =0.0.3.post33, =0.0.16, =0.9.35rc0, =0.8.7, =0.8.8 Source cves: CVE-2025-10279 Source advisory: OSV:PYSEC-2026-16...
databricks-genai (>=1.2.0a0, <=1.2.0a6), deeptrees (>=1.6.0, <=1.8.2) +1 more potentially affected by CVE-2025-10279 via mlflow (2.18.0)
mlflow PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.2.0a0, =1.6.0, =0.15.1, =0.18.0 Source cves: CVE-2025-10279 Source advisory: OSV:PYSEC-2026-1639...
databricks-genai (>=1.2.0a0, <=1.2.0a6), deeptrees (>=1.6.0, <=1.8.2) +1 more potentially affected by CVE-2025-14279 via mlflow (2.18.0)
mlflow PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.2.0a0, =1.6.0, =0.15.1, =0.18.0 Source cves: CVE-2025-14279 Source advisory: OSV:PYSEC-2026-1656...
llm-foundry (0.11.0), modeva (>=1.0.14, <=2.1.0) potentially affected by CVE-2025-14279 via mlflow (2.15.1)
mlflow PYPI version 2.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry 0.11.0 - modeva =1.0.14, =2.1.0 Source cves: CVE-2025-14279 Source advisory: OSV:PYSEC-2026-1656...
argosml (>=0.0.1, <=0.1.3), bbj-argos (0.0.1) +6 more potentially affected by CVE-2025-14279 via mlflow (2.17.2)
mlflow PYPI version 2.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - argosml =0.0.1, =2.1.3, =0.1.50.4, =0.1.6, =0.1.9.post2 - wedata-pre-code 2.0.2 Source cves: CVE-2025-14279 Source advisory: OSV:PYSEC-2026-1656...
databricks-genai (>=1.1.0, <=2.0.0a9), llm-foundry (>=0.12.0, <=0.14.5) +5 more potentially affected by CVE-2025-14279 via mlflow (2.16.2)
mlflow PYPI version 2.16.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.1.0, =0.12.0, =0.0.3.post33, =0.0.16, =0.9.35rc0, =0.8.7, =0.8.8 Source cves: CVE-2025-14279 Source advisory: OSV:PYSEC-2026-16...
llm-foundry (>=0.9.1, <=0.10.0), mlflow-pytorch-exp (0.0.1) potentially affected by CVE-2025-14279 via mlflow (2.14.3)
mlflow PYPI version 2.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry =0.9.1, =0.10.0 - mlflow-pytorch-exp 0.0.1 Source cves: CVE-2025-14279 Source advisory: OSV:PYSEC-2026-1656...
foundry-ml (>=0.0.10, <=0.0.14), funcx (>=0.0.1a6, <=0.0.6a0) +3 more potentially affected by CVE-2026-21892 via parsl (0.9.0)
parsl PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on parsl and may be impacted: - foundry-ml =0.0.10, =0.0.1a6, =0.0.3, =0.2.0.dev0, =0.1.0.dev0, =0.2.1 Source cves: CVE-2026-21892 Source advisory: OSV:PYSEC-2026-1759...
GHSA-RXRH-4J9H-XGG9 Steeltoe: TLS private keys written to /tmp with default permissions, never deleted
Summary When MySQL or PostgreSQL service bindings from VCAPSERVICES include TLS client credentials, the Connectors library writes those credentials to temporary files in Path.GetTempPath using File.CreateText. On Linux, File.CreateText creates files with mode 0644 world-readable under the process...
Steeltoe: TLS private keys written to /tmp with default permissions, never deleted
Summary When MySQL or PostgreSQL service bindings from VCAPSERVICES include TLS client credentials, the Connectors library writes those credentials to temporary files in Path.GetTempPath using File.CreateText. On Linux, File.CreateText creates files with mode 0644 world-readable under the process...
