Alta
CVE-2026-2652
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 84
Restablecer filtros
Alta
CVE-2026-2614
MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem
Alta
CVE-2026-2393
A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` function in `mlflow/server/handlers.py` accepts a user-controlled `url` parameter w
Alta
CVE-2026-44244
GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath
Media
CVE-2026-33866
MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint
Media
CVE-2026-33865
MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface
Crítica
CVE-2026-0596
Mlflow: Command Injection when serving models with enable_mlserver=True
Alta
CVE-2025-11200
MLflow Weak Password Requirements Authentication Bypass Vulnerability
Alta
CVE-2025-11201
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
Media
CVE-2025-52967
gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation.
Media
CVE-2025-1473
MLflow Cross-Site Request Forgery (CSRF) vulnerability
Media
CVE-2025-1474
In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptib
Media
CVE-2025-0453
MLflow Uncontrolled Resource Consumption vulnerability
Alta
CVE-2024-8859
MLflow has a Local File Read/Path Traversal in dbfs
Media
CVE-2024-6838
MLflow Uncontrolled Resource Consumption vulnerability
Alta
CVE-2024-27134
Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU at
Media
CVE-2024-3099
Undefined Behavior in mlflow
Alta
CVE-2024-2928
A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure t
Alta
CVE-2024-0520
A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of special elements used in an OS command ('Command Injection') within the `mlflow.data.h
Alta
CVE-2024-37057
MLFlow unsafe deserialization
Alta
CVE-2024-37058
MLFlow unsafe deserialization
Alta
CVE-2024-37060
MLFlow unsafe deserialization
Alta
CVE-2024-37054
MLFlow unsafe deserialization
Alta
CVE-2024-37052
MLFlow unsafe deserialization
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.