High
CVE-2026-2652
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 84
Reset filters
High
CVE-2026-2614
MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem
High
CVE-2026-2393
A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` function in `mlflow/server/handlers.py` accepts a user-controlled `url` parameter w
High
CVE-2026-44244
GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath
Medium
CVE-2026-33866
MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint
Medium
CVE-2026-33865
MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface
Critical
CVE-2026-0596
Mlflow: Command Injection when serving models with enable_mlserver=True
High
CVE-2025-11200
MLflow Weak Password Requirements Authentication Bypass Vulnerability
High
CVE-2025-11201
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
Medium
CVE-2025-52967
gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation.
Medium
CVE-2025-1473
MLflow Cross-Site Request Forgery (CSRF) vulnerability
Medium
CVE-2025-1474
In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptib
Medium
CVE-2025-0453
MLflow Uncontrolled Resource Consumption vulnerability
High
CVE-2024-8859
MLflow has a Local File Read/Path Traversal in dbfs
Medium
CVE-2024-6838
MLflow Uncontrolled Resource Consumption vulnerability
High
CVE-2024-27134
Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU at
Medium
CVE-2024-3099
Undefined Behavior in mlflow
High
CVE-2024-2928
A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure t
High
CVE-2024-0520
A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of special elements used in an OS command ('Command Injection') within the `mlflow.data.h
High
CVE-2024-37057
MLFlow unsafe deserialization
High
CVE-2024-37058
MLFlow unsafe deserialization
High
CVE-2024-37060
MLFlow unsafe deserialization
High
CVE-2024-37054
MLFlow unsafe deserialization
High
CVE-2024-37052
MLFlow unsafe deserialization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.