Latest vulnerabilities for "mlflow"

mlflowmlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint

Risk 50

Severity

7.7

First published (updated )

CVE-2026-71211

mlflowZDI-26-111: MLflow Use of Default Password Authentication Bypass Vulnerability

Risk 46

Severity

9.8

First published (updated )

ZDI-CAN-28256

MLflow MLflowDenial of Service through Batched Queries in GraphQL in mlflow/mlflow

Risk 43

Severity

7.5

First published (updated )

CVE-2025-0453

MLflow MLflowCSRF in mlflow/mlflow

Risk 47

Severity

7.1

First published (updated )

CVE-2025-1473

MLflow MLflowWeak Password Requirements in mlflow/mlflow

Risk 39

Severity

5.5

First published (updated )

CVE-2025-1474

MLflow MLflowPath Traversal in mlflow/mlflow

Risk 43

Severity

7.5

First published (updated )

CVE-2024-8859

MLflow MLflowUncontrolled Resource Consumption in mlflow/mlflow

Risk 27

Severity

5.3

First published (updated )

CVE-2024-6838

pip/mlflowExcessive directory permissions in MLflow leads to local privilege escalation when using spark_udf

Risk 65

Severity

7

First published (updated )

CVE-2024-27134

Lfprojects MlflowLocal File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflow

Risk 45

Severity

7.5

First published (updated )

CVE-2024-2928

Lfprojects MlflowRemote Code Execution due to Full Controlled File Write in mlflow/mlflow

Risk 90

Severity

10

First published (updated )

CVE-2024-0520

pip/mlflowDenial of Service and Data Model Poisoning via URL Encoding in mlflow/mlflow

Risk 36

Severity

5.4

First published (updated )

CVE-2024-3099

pip/mlflowCode Injection, Input Validation

Risk 57

Severity

8.8

EPSS

0.04%

First published (updated )

CVE-2024-37061

pip/mlflowDeserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.…

Risk 57

Severity

8.8

EPSS

0.04%

First published (updated )

CVE-2024-37060

pip/mlflowDeserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0…

Risk 57

Severity

8.8

EPSS

0.04%

First published (updated )

CVE-2024-37059

pip/mlflowDeserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0…

Risk 80

Severity

8.8

First published (updated )

CVE-2024-37058

pip/mlflowDeserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0…

Risk 57

Severity

8.8

EPSS

0.04%

First published (updated )

CVE-2024-37057

pip/mlflowDeserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.…

Risk 80

Severity

8.8

First published (updated )

CVE-2024-37056

pip/mlflowDeserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.…

Risk 57

Severity

8.8

EPSS

0.04%

First published (updated )

CVE-2024-37055

pip/mlflowDeserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0…

Risk 57

Severity

8.8

EPSS

0.04%

First published (updated )

CVE-2024-37054

pip/mlflowDeserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0…

Risk 80

Severity

8.8

First published (updated )

CVE-2024-37053

pip/mlflowDeserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0…

Risk 80

Severity

8.8

First published (updated )

CVE-2024-37052

Lfprojects MlflowPath Traversal Bypass in mlflow/mlflow

Risk 31

Severity

7.5

EPSS

0.04%

First published (updated )

CVE-2024-3848

pip/mlflowLocal File Read via Path Traversal in mlflow/mlflow

Risk 45

Severity

7.5

First published (updated )

CVE-2024-1594

pip/mlflowPath Traversal Vulnerability in mlflow/mlflow

Risk 45

Severity

7.5

First published (updated )

CVE-2024-1483

pip/mlflowPath Traversal via Parameter Smuggling in mlflow/mlflow

Risk 45

Severity

7.5

First published (updated )

CVE-2024-1593

pip/mlflowPath Traversal Vulnerability in mlflow/mlflow

Risk 45

Severity

7.5

First published (updated )

CVE-2024-1558

Lfprojects MlflowLocal File Inclusion (LFI) via Scheme Confusion in mlflow/mlflow

Risk 44

Severity

9.3

EPSS

0.04%

First published (updated )

CVE-2024-3573

pip/mlflowPath Traversal Vulnerability in mlflow/mlflow

Risk 62

Severity

8.1

First published (updated )

CVE-2024-1560

pip/mlflowPath Traversal: '\..\filename'

Risk 59

Severity

10

EPSS

0.56%

First published (updated )

CVE-2023-6977

pip/mlflowUnrestricted Upload of File with Dangerous Type

Risk 57

Severity

8.8

EPSS

0.05%

First published (updated )

CVE-2023-6976

Trending

Versions

mlflowmlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint

mlflowZDI-26-111: MLflow Use of Default Password Authentication Bypass Vulnerability

MLflow MLflowDenial of Service through Batched Queries in GraphQL in mlflow/mlflow

MLflow MLflowCSRF in mlflow/mlflow

MLflow MLflowWeak Password Requirements in mlflow/mlflow

Don't miss critical vulnerabilities

MLflow MLflowPath Traversal in mlflow/mlflow

MLflow MLflowUncontrolled Resource Consumption in mlflow/mlflow

pip/mlflowExcessive directory permissions in MLflow leads to local privilege escalation when using spark_udf

Lfprojects MlflowLocal File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflow

Lfprojects MlflowRemote Code Execution due to Full Controlled File Write in mlflow/mlflow

Don't miss critical vulnerabilities

pip/mlflowDenial of Service and Data Model Poisoning via URL Encoding in mlflow/mlflow

pip/mlflowCode Injection, Input Validation

pip/mlflowDeserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.…

pip/mlflowDeserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0…

pip/mlflowDeserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0…

Don't miss critical vulnerabilities

pip/mlflowDeserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0…

pip/mlflowDeserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.…

pip/mlflowDeserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.…

pip/mlflowDeserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0…

pip/mlflowDeserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0…

Don't miss critical vulnerabilities

pip/mlflowDeserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0…

Lfprojects MlflowPath Traversal Bypass in mlflow/mlflow

pip/mlflowLocal File Read via Path Traversal in mlflow/mlflow

pip/mlflowPath Traversal Vulnerability in mlflow/mlflow

pip/mlflowPath Traversal via Parameter Smuggling in mlflow/mlflow

Don't miss critical vulnerabilities

pip/mlflowPath Traversal Vulnerability in mlflow/mlflow

Lfprojects MlflowLocal File Inclusion (LFI) via Scheme Confusion in mlflow/mlflow

pip/mlflowPath Traversal Vulnerability in mlflow/mlflow

pip/mlflowPath Traversal: '\..\filename'

pip/mlflowUnrestricted Upload of File with Dangerous Type

Don't miss critical vulnerabilities

Company

Resources

Contact