ML
Product
mlflow
On CISA KEVExploited in the wild
18
CVEs
1
On KEV
9.8
Max CVSS
5
New 30D
Severity mix
Critical 2High 10Medium 5Low 1
Watch
Add mlflow to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-64849 In wildKEV | 9.3 | Aug 17 | MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) Affected: >= 3.3.0, < 3.15.0 |
| CVE-2026-116692 New | 9.8 | Oct 27 | MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules Affected: >= 3.12.0rc0, < 3.17.0 |
Showing 2