Medium
CVE-2026-40610
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 17
Reset filters
High
CVE-2026-27905
BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction
High
CVE-2026-15035
A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function async_run_command of the file src/openllm/common.py of the component Model Repository Directory Name Handler. Performing
High
CVE-2026-24123
BentoML has a Path Traversal via Bentofile Configuration
High
CVE-2024-9056
BentoML Denial of Service (DoS) via Multipart Boundary
Critical
CVE-2025-54381
BentoML SSRF Vulnerability in File Upload Processing
Critical
CVE-2025-27520
BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization
High
CVE-2026-44345
BentoML Dockerfile command injection via docker.base_image (sister of pending GHSA-w2pm-x38x-jp44 / CVE-2026-33744 / CVE-2026-35043)
High
CVE-2026-44346
Dockerfile command injection via envs[*].name in bentofile.yaml (sibling fix-bypass of CVE-2026-33744 and CVE-2026-35043)
High
CVE-2026-35044
BentoML: SSTI via Unsandboxed Jinja2 in Dockerfile Generation
High
CVE-2026-35043
BentoML: Command Injection in cloud deployment setup script
High
CVE-2026-33744
BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml
Critical
CVE-2025-32375
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.8, there was an insecure deserialization in BentoML's runner server. By setting
Critical
CVE-2024-9070
BentoML deserialization vulnerability
Medium
ghsa-564p-rx2q-4c8v
BentoML Open Redirect vulnerability
High
ghsa-hh3j-9m59-p8vc
BentoML vulnerable to Uncontrolled Resource Consumption
Critical
CVE-2024-2912
Insecure deserialization in BentoML
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.