Alta
CVE-2026-71211
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 84
Restablecer filtros
Alta
ghsa-gqvg-gmmx-x4hm
MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact
Crítica
Explotada en ataques
CVE-2026-64849
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
Alta
CVE-2026-4137
MLFlow Creates a Temporary File With Insecure Permissions
Alta
CVE-2025-15381
MLFlow allows Tracing + Assessments Access
Alta
CVE-2025-15031
Arbitrary file write via tar traversal in mlflow
Alta
CVE-2025-14287
MLflow has a command injection in mlflow/sagemaker/__init__.py
Alta
CVE-2026-2033
MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability
Alta
CVE-2025-10279
mlflow Creates of Temporary File in Directory with Insecure Permissions
Alta
CVE-2025-14279
MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validation
Alta
CVE-2026-22607
Fickling Blocklist Bypass: cProfile.run()
Alta
CVE-2024-37061
MLFlow improper input validation
Alta
CVE-2024-37059
MLFlow unsafe deserialization
Alta
CVE-2026-8147
MLflow: trace API endpoints lack proper authorization validators
Crítica
CVE-2026-2635
MLflow Use of Default Password Authentication Bypass Vulnerability
Crítica
CVE-2026-2611
MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution
Crítica
CVE-2026-0545
mlflow: FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization
Crítica
CVE-2025-15036
MLFlow path traversal vulnerability
Crítica
CVE-2025-15379
MLflow Command Injection vulnerability
Baja
CVE-2026-10803
A flaw has been found in MLflow up to 3.10.0. This issue affects the function mlflow.data.digest_utils of the file mlflow/data/digest_utils.py of the component Dataset Digest Computation. This manipul
Alta
CVE-2026-4035
A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environme
Media
CVE-2026-3198
MLflow: Any authenticated user can enumerate all gateway secrets, endpoints, and model definitions
Crítica
CVE-2026-2651
MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled
Media
CVE-2026-2734
MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.