ML
Product
mlflow/mlflow
18
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 6High 10Medium 2Low 0
Watch
Add mlflow/mlflow to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-15379 | 10.0 | Mar 30 | Command Injection in mlflow/mlflow Affected: before 3.8.2 |
| CVE-2025-15036 | 10.0 | Mar 30 | Path Traversal Vulnerability in mlflow/mlflow Affected: before 3.9.0 |
| CVE-2026-0545 | 9.8 | Apr 3 | Missing Authentication for Critical Function in mlflow/mlflow Affected: through latest |
| CVE-2026-2611 | 9.6 | May 19 | Improper Origin Validation in mlflow/mlflow Affected: before 3.10.0 |
| CVE-2025-15031 | 9.1 | Mar 18 | Path Traversal Vulnerability in mlflow/mlflow Affected: through latest |
| CVE-2026-2651 | 9.0 | May 25 | Missing Authorization Validation in mlflow/mlflow Affected: before 3.10.0 |
| CVE-2025-14287 | 8.8 | Mar 15 | Command Injection in mlflow/mlflow Affected: through latest |
| CVE-2026-2652 | 8.6 | May 15 | Authentication Bypass in mlflow/mlflow Affected: before 3.10.0 |
| CVE-2026-8147 | 8.1 | Jul 2 | Authorization Bypass in mlflow/mlflow Affected: before 3.14.0 |
| CVE-2026-4137 | 7.8 | May 18 | Incomplete Fix for CVE-2025-10279: Insecure Temporary Directory Permissions in mlflow/mlflow Affected: before 3.11.0 |
| CVE-2026-0596 | 7.8 | Mar 31 | Command Injection in mlflow/mlflow Affected: through latest |
| CVE-2026-4035 | 7.7 | Jun 3 | Environment Variable Resolution Vulnerability in mlflow/mlflow Affected: before 3.11.0 |
| CVE-2026-2614 | 7.5 | May 11 | Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflow Affected: before 3.10.0 |
| CVE-2026-2393 | 7.1 | May 11 | Server-Side Request Forgery (SSRF) in mlflow/mlflow Affected: before 3.10.0 |
| CVE-2025-15381 | 7.1 | Mar 27 | Unauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflow Affected: through latest |
| CVE-2025-10279 | 7.0 | Feb 2 | Privilege Escalation in mlflow/mlflow Affected: before 3.4.0 |
| CVE-2026-3198 | 6.5 | Jun 2 | Improper Access Control in mlflow/mlflow Affected: through latest |
| CVE-2026-2734 | 6.5 | May 21 | Authorization Bypass in SearchModelVersions in mlflow/mlflow Affected: before 3.10.0 |
Showing 18