EUVD-2023-0156

Malicious code in bioql PyPI...

EUVD-2024-1979

Malicious code in bioql PyPI...

EUVD-2024-2030

Malicious code in bioql PyPI...

EUVD-2024-2125

Malicious code in bioql PyPI...

EUVD-2023-0162

Malicious code in bioql PyPI...

EUVD-2024-1956

Malicious code in bioql PyPI...

EUVD-2024-2203

Malicious code in bioql PyPI...

EUVD-2025-6810

Malicious code in bioql PyPI...

EUVD-2024-2191

Malicious code in bioql PyPI...

EUVD-2024-1239

Malicious code in bioql PyPI...

EUVD-2025-6808

Malicious code in bioql PyPI...

EUVD-2024-0533

Malicious code in bioql PyPI...

MLflow Weak Password Requirements Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. The issue results from weak password requirements. An attacker can...

PT-2025-40607

Name of the Vulnerable Software and Affected Versions MLflow affected versions not specified Description This issue allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this flaw, which stems from weak password requirement...

MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of model file paths. The issue results from the lack of proper...

PT-2025-40608

Name of the Vulnerable Software and Affected Versions MLflow Tracking Server affected versions not specified Description The MLflow Tracking Server contains a directory traversal flaw that allows remote attackers to execute arbitrary code on affected systems. Authentication is not required for...

CVE-2025-59420 vulnerabilities

Vulnerabilities for packages: open-webui, mlflow...

GHSA-9GGR-2464-2J32 vulnerabilities

Vulnerabilities for packages: open-webui, mlflow...

BIT-MLFLOW-2025-52967

gatewayproxyhandler in MLflow before 3.1.0 lacks gatewaypath validation...

Creation of Temporary File With Insecure Permissions

Overview Affected versions of this package are vulnerable to Creation of Temporary File With Insecure Permissions in the getorcreatetmpdir function in fileutils.py. This enables an attacker who can write to /tmp to cause the execution of arbitrary .py files during environment setup. Remediation...