| CVE-2026-4035 |
A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI…
|
9.1
Critique
|
3 juin 2026 |
| CVE-2026-2651 |
A vulnerability in MLflow…
|
9.0
Critique
|
25 mai 2026 |
| CVE-2026-2611 |
In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints
|
9.6
Critique
|
19 mai 2026 |
| CVE-2026-0545 |
In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or…
|
9.1
Critique
|
3 avr. 2026 |
| CVE-2026-0596 |
A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`
|
9.6
Critique
|
31 mars 2026 |
| CVE-2025-15379 |
A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the…
|
10.0
Critique
|
30 mars 2026 |
| CVE-2025-15036 |
A path traversal vulnerability exists in the `extract_archive_to_dir` function within the…
|
9.6
Critique
|
30 mars 2026 |
| CVE-2024-0520 |
A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of…
|
10.0
Critique
|
6 juin 2024 |
| CVE-2024-3573 |
mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to…
|
9.3
Critique
|
16 avr. 2024 |
| CVE-2023-6977 |
This vulnerability enables malicious users to read sensitive files on the server
|
10.0
Critique
|
20 déc. 2023 |
| CVE-2023-6975 |
A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models…
|
9.8
Critique
|
20 déc. 2023 |
| CVE-2023-6940 |
with only one user interaction(download a malicious config), attackers can gain full command execution on the victim…
|
9.0
Critique
|
19 déc. 2023 |
| CVE-2023-6753 |
Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2
|
9.6
Critique
|
13 déc. 2023 |
| CVE-2023-6709 |
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2
|
10.0
Critique
|
12 déc. 2023 |
| CVE-2023-6014 |
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment
|
9.1
Critique
|
16 nov. 2023 |
| CVE-2023-6015 |
MLflow allowed arbitrary files to be PUT onto the server
|
10.0
Critique
|
16 nov. 2023 |
| CVE-2023-6018 |
An attacker can overwrite any file on the server hosting MLflow without any authentication
|
10.0
Critique
|
16 nov. 2023 |
| CVE-2023-3765 |
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0
|
10.0
Critique
|
19 juil. 2023 |
| CVE-2023-2780 |
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1
|
9.8
Critique
|
17 mai 2023 |
| CVE-2023-2356 |
Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1
|
10.0
Critique
|
28 avr. 2023 |
| CVE-2023-1177 |
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1
|
9.3
Critique
|
24 mars 2023 |