Hoch
CVE-2026-2652
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 84
Filter zurücksetzen
Hoch
CVE-2026-2614
MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem
Hoch
CVE-2026-2393
A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` function in `mlflow/server/handlers.py` accepts a user-controlled `url` parameter w
Hoch
CVE-2026-44244
GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath
Mittel
CVE-2026-33866
MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint
Mittel
CVE-2026-33865
MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface
Kritisch
CVE-2026-0596
Mlflow: Command Injection when serving models with enable_mlserver=True
Hoch
CVE-2025-11200
MLflow Weak Password Requirements Authentication Bypass Vulnerability
Hoch
CVE-2025-11201
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
Mittel
CVE-2025-52967
gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation.
Mittel
CVE-2025-1473
MLflow Cross-Site Request Forgery (CSRF) vulnerability
Mittel
CVE-2025-1474
In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptib
Mittel
CVE-2025-0453
MLflow Uncontrolled Resource Consumption vulnerability
Hoch
CVE-2024-8859
MLflow has a Local File Read/Path Traversal in dbfs
Mittel
CVE-2024-6838
MLflow Uncontrolled Resource Consumption vulnerability
Hoch
CVE-2024-27134
Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU at
Mittel
CVE-2024-3099
Undefined Behavior in mlflow
Hoch
CVE-2024-2928
A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure t
Hoch
CVE-2024-0520
A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of special elements used in an OS command ('Command Injection') within the `mlflow.data.h
Hoch
CVE-2024-37057
MLFlow unsafe deserialization
Hoch
CVE-2024-37058
MLFlow unsafe deserialization
Hoch
CVE-2024-37060
MLFlow unsafe deserialization
Hoch
CVE-2024-37054
MLFlow unsafe deserialization
Hoch
CVE-2024-37052
MLFlow unsafe deserialization
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.