EUVD-2026-109184

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, the scorer invoke, register, and GenAI evaluate endpoints, including unauthenticated POST /ajax-api/3.0/mlflow/scorer/invoke, accept serialized third-party...

jit-cli (0.1.0), langchain-icosa (>=1.0.0, <=1.1.2) +3 more potentially affected by CVE-2026-26013 via langchain-core (0.2.24)

langchain-core PYPI version 0.2.24 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - jit-cli 0.1.0 - langchain-icosa =1.0.0, =1.2.0, =1.2.0, =1.2.6 Source cves: CVE-2026-26013 Source advisory: OSV:GHSA-2G6R-C272-W58R...