databricks-genai (>=1.1.0, <=2.0.0a9), llm-foundry (>=0.12.0, <=0.14.5) +5 more potentially affected by CVE-2026-33865 via mlflow (2.16.2)

mlflow PYPI version 2.16.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.1.0, =0.12.0, =0.0.3.post33, =0.0.16, =0.9.35rc0, =0.8.7, =0.8.8 Source cves: CVE-2026-33865 Source advisory:...

llm-foundry (>=0.9.1, <=0.10.0), mlflow-pytorch-exp (0.0.1) potentially affected by CVE-2026-33866 via mlflow (2.14.3)

mlflow PYPI version 2.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry =0.9.1, =0.10.0 - mlflow-pytorch-exp 0.0.1 Source cves: CVE-2026-33866 Source advisory: OSV:GHSA-46R5-X6JQ-V8G6...

llm-foundry (0.11.0), modeva (>=1.0.14, <=2.1.0) potentially affected by CVE-2026-33866 via mlflow (2.15.1)

mlflow PYPI version 2.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry 0.11.0 - modeva =1.0.14, =2.1.0 Source cves: CVE-2026-33866 Source advisory: OSV:GHSA-46R5-X6JQ-V8G6...

databricks-genai (>=1.2.0a0, <=1.2.0a6), deeptrees (>=1.6.0, <=1.8.2) +1 more potentially affected by CVE-2026-33865 via mlflow (2.18.0)

mlflow PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.2.0a0, =1.6.0, =0.15.1, =0.18.0 Source cves: CVE-2026-33865 Source advisory: OSV:GHSA-FH64-R2VC-XVHR...

databricks-genai (>=1.2.0a0, <=1.2.0a6), deeptrees (>=1.6.0, <=1.8.2) +1 more potentially affected by CVE-2026-33866 via mlflow (2.18.0)

mlflow PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.2.0a0, =1.6.0, =0.15.1, =0.18.0 Source cves: CVE-2026-33866 Source advisory: OSV:GHSA-46R5-X6JQ-V8G6...

llm-foundry (0.11.0), modeva (>=1.0.14, <=2.1.0) potentially affected by CVE-2026-33865 via mlflow (2.15.1)

mlflow PYPI version 2.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry 0.11.0 - modeva =1.0.14, =2.1.0 Source cves: CVE-2026-33865 Source advisory: OSV:GHSA-FH64-R2VC-XVHR...

llm-foundry (>=0.9.1, <=0.10.0), mlflow-pytorch-exp (0.0.1) potentially affected by CVE-2026-33865 via mlflow (2.14.3)

mlflow PYPI version 2.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry =0.9.1, =0.10.0 - mlflow-pytorch-exp 0.0.1 Source cves: CVE-2026-33865 Source advisory: OSV:GHSA-FH64-R2VC-XVHR...

azureml-evaluate-mlflow (>=0.0.57, <=0.0.58), eensight (>=1.0.0, <=1.0.2) +6 more potentially affected by CVE-2026-33865 via mlflow (2.12.2)

mlflow PYPI version 2.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-evaluate-mlflow =0.0.57, =1.0.0, =0.8.0, =0.0.6, =0.6.0.dev0, =0.10.0, =0.10.2 Source cves: CVE-2026-33865 Source advisory:...

databricks-genai (>=1.1.0, <=2.0.0a9), llm-foundry (>=0.12.0, <=0.14.5) +5 more potentially affected by CVE-2026-33865 +1 more via mlflow (2.16.2)

mlflow PYPI version 2.16.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.1.0, =0.12.0, =0.0.3.post33, =0.0.16, =0.9.35rc0, =0.8.7, =0.8.8 Source cves: CVE-2026-33865, CVE-2026-33866 Source advisory:...

databricks-genai (>=1.2.0a0, <=1.2.0a6), deeptrees (>=1.6.0, <=1.8.2) +1 more potentially affected by CVE-2026-33865 +1 more via mlflow (2.18.0)

mlflow PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.2.0a0, =1.6.0, =0.15.1, =0.18.0 Source cves: CVE-2026-33865, CVE-2026-33866 Source advisory: OSV:PYSEC-2026-94...

llm-foundry (0.11.0), modeva (>=1.0.14, <=2.1.0) potentially affected by CVE-2026-33865 +1 more via mlflow (2.15.1)

mlflow PYPI version 2.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry 0.11.0 - modeva =1.0.14, =2.1.0 Source cves: CVE-2026-33865, CVE-2026-33866 Source advisory: OSV:PYSEC-2026-94...

llm-foundry (>=0.9.1, <=0.10.0), mlflow-pytorch-exp (0.0.1) potentially affected by CVE-2026-33865 +1 more via mlflow (2.14.3)

mlflow PYPI version 2.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry =0.9.1, =0.10.0 - mlflow-pytorch-exp 0.0.1 Source cves: CVE-2026-33865, CVE-2026-33866 Source advisory: OSV:PYSEC-2026-94...

databricks-genai (>=1.2.0a0, <=1.2.0a6), deeptrees (>=1.6.0, <=1.8.2) +1 more potentially affected by CVE-2026-33865 via mlflow (2.18.0)

mlflow PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.2.0a0, =1.6.0, =0.15.1, =0.18.0 Source cves: CVE-2026-33865 Source advisory: OSV:PYSEC-2026-93...

databricks-genai (>=1.1.0, <=2.0.0a9), llm-foundry (>=0.12.0, <=0.14.5) +5 more potentially affected by CVE-2026-33865 via mlflow (2.16.2)

mlflow PYPI version 2.16.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.1.0, =0.12.0, =0.0.3.post33, =0.0.16, =0.9.35rc0, =0.8.7, =0.8.8 Source cves: CVE-2026-33865 Source advisory: OSV:PYSEC-2026-93...

azureml-evaluate-mlflow (>=0.0.57, <=0.0.58), eensight (>=1.0.0, <=1.0.2) +6 more potentially affected by CVE-2026-33865 via mlflow (2.12.2)

mlflow PYPI version 2.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-evaluate-mlflow =0.0.57, =1.0.0, =0.8.0, =0.0.6, =0.6.0.dev0, =0.10.0, =0.10.2 Source cves: CVE-2026-33865 Source advisory: OSV:PYSEC-2026-...

llm-foundry (0.11.0), modeva (>=1.0.14, <=2.1.0) potentially affected by CVE-2026-33865 via mlflow (2.15.1)

mlflow PYPI version 2.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry 0.11.0 - modeva =1.0.14, =2.1.0 Source cves: CVE-2026-33865 Source advisory: OSV:PYSEC-2026-93...

llm-foundry (>=0.9.1, <=0.10.0), mlflow-pytorch-exp (0.0.1) potentially affected by CVE-2026-33865 via mlflow (2.14.3)

mlflow PYPI version 2.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry =0.9.1, =0.10.0 - mlflow-pytorch-exp 0.0.1 Source cves: CVE-2026-33865 Source advisory: OSV:PYSEC-2026-93...

foundry-db (>=0.1.0, <=0.1.30), foundry-db-temp (>=0.1.9, <=0.1.12) +15 more potentially affected by CVE-2026-35167 via kedro (0.19.15)

kedro PYPI version 0.19.15 is affected by a known vulnerability. The following packages have a transitive dependency on kedro and may be impacted: - foundry-db =0.1.0, =0.1.9, =0.1.0, =0.0.4, =0.2.0, =0.0.1b1, =0.2.1, =0.5.0, =0.12.2, =0.2.0, =0.2.0, =0.11.1, =0.12.0 and more Source cves:...

foundry-db (>=0.1.0, <=0.1.30), foundry-db-temp (>=0.1.9, <=0.1.12) +15 more potentially affected by CVE-2026-35171 via kedro (0.19.15)

kedro PYPI version 0.19.15 is affected by a known vulnerability. The following packages have a transitive dependency on kedro and may be impacted: - foundry-db =0.1.0, =0.1.9, =0.1.0, =0.0.4, =0.2.0, =0.0.1b1, =0.2.1, =0.5.0, =0.12.2, =0.2.0, =0.2.0, =0.11.1, =0.12.0 and more Source cves:...

CVE-2026-22734 - UAA SAML 2.0 Signature Bypass | Cloud Foundry

Severity 8.8 / High CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N 8.6 / HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Vendor CloudFoundry Foundation Description Cloud Foundry UAA versions v77.21.0 through v78.8.0 are vulnerable to a bypass that allows an attacker to obtain a...