1264 matches found
PT-2026-39649
Name of the Vulnerable Software and Affected Versions MLflow versions prior to 3.9.0 Description A Server-Side Request Forgery SSRF issue exists where the create webhook function in mlflow/server/handlers.py accepts a user-controlled url parameter without validation. Subsequently, the send webhoo...
MLflow 代码问题漏洞
MLflow is an open-source platform that simplifies machine learning development. It includes features for tracking experiments, packaging code for reproducible runs, and sharing and deploying models. Versions of MLflow prior to 3.9.0 contained code vulnerabilities. These vulnerabilities stemmed fr...
GHSA-MV93-W799-CJ2W vulnerabilities
Vulnerabilities for packages: mlflow...
CVE-2026-42215 vulnerabilities
Vulnerabilities for packages: mlflow-fips, awx, opal, datahub-ingestion-fips, open-webui, checkov, mlflow...
CVE-2026-42284 vulnerabilities
Vulnerabilities for packages: mlflow-fips, awx, opal, datahub-ingestion-fips, open-webui, checkov, mlflow...
CVE-2026-41205 vulnerabilities
Vulnerabilities for packages: dagster-fips, airflow, jupyter-base-notebook, open-webui, airflow-core, prefect-fips, dagster, mlflow, nemo, pgadmin4-fips, superset...
CVE-2026-41425 vulnerabilities
Vulnerabilities for packages: datahub-ingestion, airflow, datahub-ingestion-fips, open-webui, mlflow, pgadmin4-fips...
CVE-2026-42215 vulnerabilities
Vulnerabilities for packages: open-webui, mlflow, checkov...
CVE-2026-42284 vulnerabilities
Vulnerabilities for packages: open-webui, mlflow, checkov...
CVE-2026-41205 vulnerabilities
Vulnerabilities for packages: jupyter-base-notebook, superset, open-webui, airflow, mlflow...
CVE-2026-41425 vulnerabilities
Vulnerabilities for packages: airflow, open-webui, mlflow...
VulnCheck KEV: CVE-2023-6909
Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2...
BIT-MLFLOW-2025-15379 Command Injection in mlflow/mlflow
A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the installmodeldependenciestoenv function. When deploying a model with envmanager=LOCAL, MLflow reads dependency specifications from the model artifact's pythonenv.yaml file and...
BIT-MLFLOW-2025-15036 Path Traversal Vulnerability in mlflow/mlflow
A path traversal vulnerability exists in the extractarchivetodir function within the mlflow/pyfunc/dbconnectartifactcache.py file of the mlflow/mlflow repository. This vulnerability, present in versions before v3.7.0, arises due to the lack of validation of tar member paths during extraction. An...
GHSA-46R5-X6JQ-V8G6 vulnerabilities
Vulnerabilities for packages: mlflow...
CVE-2026-33866 vulnerabilities
Vulnerabilities for packages: mlflow...
CVE-2026-33865 vulnerabilities
Vulnerabilities for packages: mlflow...
GHSA-FH64-R2VC-XVHR vulnerabilities
Vulnerabilities for packages: mlflow...