PyPI Package Vulnerabilities

Packages

tensorflow433 vulnerabilities
tensorflow-gpu427 vulnerabilities
tensorflow-cpu423 vulnerabilities
Django147 vulnerabilities
open-webui133 vulnerabilities
apache-airflow129 vulnerabilities
Plone96 vulnerabilities
mlflow79 vulnerabilities
apache-superset67 vulnerabilities
salt67 vulnerabilities
ansible66 vulnerabilities
pillow61 vulnerabilities
picklescan59 vulnerabilities
vllm59 vulnerabilities
gradio49 vulnerabilities
nova49 vulnerabilities
aiohttp48 vulnerabilities
pyload-ng48 vulnerabilities
matrix-synapse45 vulnerabilities
vyper44 vulnerabilities
rdiffweb43 vulnerabilities
praisonai40 vulnerabilities
keystone39 vulnerabilities
pypdf39 vulnerabilities
PraisonAI37 vulnerabilities

PyPI vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2026-8147HIGH	Authorization Bypass in mlflow/mlflow In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any authenticated user to bypass experiment-level authorization controls on all trace operations, including reading, deleting, and modifying traces on experiments they do not have permission to access. The issue arises from the `_before_request` handler, which does not register authorization validators for trace endpoints, resulting in requests p… CWE-284Jul 2, 2026	CVSS8.1v3.0	EPSS0.376%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-10803LOW	MLflow Dataset Digest Computation digest_utils.py mlflow.data.digest_utils weak hash A flaw has been found in MLflow up to 3.10.0. This issue affects the function mlflow.data.digest_utils of the file mlflow/data/digest_utils.py of the component Dataset Digest Computation. This manipulation causes use of weak hash. It is possible to launch the attack on the local host. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit has been published and may be used. The project was informed of the problem early through a pull request bu… CWE-327 CWE-328Jun 4, 2026	CVSS2.0v4.0	EPSS0.103%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-4035HIGH	Environment Variable Resolution Vulnerability in mlflow/mlflow A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environment credentials to an attacker-controlled endpoint. This issue arises because the `api_key` field in gateway secrets can accept `$ENV_VAR` references, which are resolved against the MLflow server's environment during runtime. The resolved secrets are then sent in provider authentication headers to th… CWE-201Jun 3, 2026	CVSS7.7v3.1	EPSS0.435%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-3198MEDIUM	Improper Access Control in mlflow/mlflow MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API 'list' endpoints. Specifically, the `BEFORE_REQUEST_HANDLERS` dictionary in `mlflow/server/auth/__init__.py` does not include entries for `ListGatewaySecretInfos`, `ListGatewayEndpoints`, and `ListGatewayModelDefinitions`. This allows any authenticated user, regardless of their assigned permissions, to enumerate all gateway secrets, endpoints, and model definitions. This vulnerab… CWE-284Jun 2, 2026	CVSS6.5v3.0	EPSS0.244%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-2651CRITICAL	Missing Authorization Validation in mlflow/mlflow A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/mlflow-artifacts/mpu/*` endpoints, enabling attackers to overwrite artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded. The issue is re… CWE-1220 CWE-862May 25, 2026	CVSS9.0v3.1	EPSS0.345%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-2734MEDIUM	Authorization Bypass in SearchModelVersions in mlflow/mlflow In mlflow/mlflow versions up to 3.9.0, the `SearchModelVersions` REST API endpoint and the `mlflowSearchModelVersions` GraphQL query lack proper per-model authorization checks when basic authentication is enabled. This allows any authenticated user to enumerate all model versions across all registered models, regardless of their permission level. The issue arises due to the absence of `SearchModelVersions` in the `BEFORE_REQUEST_VALIDATORS` and `AFTER_REQUEST_HANDLERS` for the REST API, and its … CWE-284May 21, 2026	CVSS6.5v3.0	EPSS0.441%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-2611CRITICAL	Improper Origin Validation in mlflow/mlflow In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-a… CWE-346 CWE-940May 19, 2026	CVSS9.6v3.1	EPSS0.384%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-4137HIGH	Incomplete Fix for CVE-2025-10279: Insecure Temporary Directory Permissions in mlflow/mlflow In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in `mlflow/utils/file_utils.py` creates temporary directories with world-writable permissions (0o777), and the `_create_model_downloading_tmp_dir()` function in `mlflow/pyfunc/__init__.py` creates directories with group-writable permissions (0o770). These insecure permissions allow local attackers to tamper with model artifacts, such as cloudpickle-serialized Python objects, and achieve arbitrary code execution… CWE-378May 18, 2026	CVSS7.8v3.1	EPSS0.193%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-2652HIGH	Authentication Bypass in mlflow/mlflow A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and served via uvicorn (ASGI). The FastAPI permission middleware only enforces authentication on `/gateway/` routes, leaving other routes such as the Job API (`/ajax-api/3.0/jobs/*`) and the OpenTelemetry trace ingestion API (`/v1/traces`) unprotected. This allows unauthenticated remote attackers to su… CWE-305May 15, 20261 related artifact	CVSS8.6v3.0	EPSS18.9%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template	STIX
CVE-2026-2614HIGH	Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflow A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue arises when a `CreateModelVersion` request includes the tag `mlflow.prompt.is_prompt`, which bypasses source path validation. This enables an attacker to store an arbitrary local filesystem path as the model version source. The `get_model_version_artifact_handle… CWE-22May 11, 2026	CVSS7.5v3.1	EPSS0.712%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-2393HIGH	Server-Side Request Forgery (SSRF) in mlflow/mlflow A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` function in `mlflow/server/handlers.py` accepts a user-controlled `url` parameter without validation, and the `_send_webhook_request()` function in `mlflow/webhooks/delivery.py` sends HTTP POST requests to this attacker-controlled URL. This allows an authenticated attacker to force the MLflow backend to send HTTP requests to internal services, cloud metadata endpoints, or arbitrar… CWE-918May 11, 2026	CVSS7.1v3.0	EPSS0.288%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-33866MEDIUM	Authorization Bypass in MLflow AJAX Endpoint MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint used to download saved model artifacts. Due to missing access‑control validation, a user without permissions to a given experiment can directly query this endpoint and retrieve model artifacts they are not authorized to access. This issue affects MLflow version through 3.10.1 CWE-862Apr 7, 2026	CVSS5.3v4.0	EPSS0.362%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-33865MEDIUM	Stored XSS via unsafe YAML parsing in MLflow MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attacker can upload a malicious MLmodel file containing a payload that executes when another user views the artifact in the UI. This allows actions such as session hijacking or performing operations on behalf of the victim. This issue affects MLflow version through 3.10.1 CWE-79Apr 7, 2026	CVSS5.1v4.0	EPSS0.218%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-0545CRITICAL	Missing Authentication for Critical Function in mlflow/mlflow In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled. This vulnerability affects the latest version of the repository. If job execution is enabled (`MLFLOW_SERVER_ENABLE_JOB_EXECUTION=true`) and any job function is allowlisted, any network client can submit, read, search, and cancel jobs without credentials, bypassing basic-auth entirely. This can lead to unauthenticated remote code exec… CWE-306Apr 3, 20261 related artifact	CVSS9.8v3.1	EPSS4.39%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template	STIX
CVE-2026-0596HIGH	Command Injection in mlflow/mlflow A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`. The `model_uri` is embedded directly into a shell command executed via `bash -c` without proper sanitization. If the `model_uri` contains shell metacharacters, such as `$()` or backticks, it allows for command substitution and execution of attacker-controlled commands. This vulnerability affects the latest version of mlflow/mlflow and can lead to privilege escalation if a higher-privileged… CWE-78Mar 31, 2026	CVSS7.8v3.1	EPSS1.33%	PoCs1	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-15379CRITICAL	Command Injection in mlflow/mlflow A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function. When deploying a model with `env_manager=LOCAL`, MLflow reads dependency specifications from the model artifact's `python_env.yaml` file and directly interpolates them into a shell command without sanitization. This allows an attacker to supply a malicious model artifact and achieve arbitrary command execution on systems that deplo… CWE-77 CWE-78Mar 30, 2026	CVSS9.8v3.1	EPSS1.99%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-15036CRITICAL	Path Traversal Vulnerability in mlflow/mlflow A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artifact_cache.py` file of the mlflow/mlflow repository. This vulnerability, present in versions before v3.7.0, arises due to the lack of validation of tar member paths during extraction. An attacker with control over the tar.gz file can exploit this issue to overwrite arbitrary files or gain elevated privileges, potentially escaping the sandbox directory in multi-tenant or shared c… CWE-22 CWE-29Mar 30, 2026	CVSS10.0v3.1	EPSS0.579%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-15381HIGH	Unauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflow In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with `NO_PERMISSIONS` on the experiment, to read trace information and create assessments for traces they should not have access to. This vulnerability impacts confidentiality by exposing trace metadata and integrity by allowing unauthorized creation of assessments. Deployments using `mlflow … CWE-200 CWE-425Mar 27, 2026	CVSS8.1v3.1	EPSS0.331%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-15031CRITICAL	Path Traversal Vulnerability in mlflow/mlflow A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries. Specifically, the use of `tarfile.extractall` without path validation enables crafted tar.gz files containing `..` or absolute paths to escape the intended extraction directory. This issue affects the latest version of MLflow and poses a high/critical risk in scenarios involving multi-tenant environments or ingestion of untrusted artifacts, as it can lead to arb… CWE-22Mar 18, 2026	CVSS9.1v3.1	EPSS0.852%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-14287HIGH	Command Injection in mlflow/mlflow A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the `mlflow/sagemaker/__init__.py` file at lines 161-167. The vulnerability arises from the direct interpolation of user-supplied container image names into shell commands without proper sanitization, which are then executed using `os.system()`. This allows attackers to execute arbitrary commands by supplying malicious input through the `--container` parameter of the CLI. The issue affects environme… CWE-78 CWE-94Mar 15, 2026	CVSS8.8v3.1	EPSS1.46%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-2635HIGH	MLflow Use of Default Password Authentication Bypass Vulnerability MLflow Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the basic_auth.ini file. The file contains hard-coded default credentials. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of the administrator. Was ZDI-CAN-28256. CWE-1393 CWE-798Feb 20, 2026	CVSS7.3v3.1	EPSS0.968%	PoCs1	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-2033HIGH	MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of artifact file paths. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vuln… CWE-22Feb 20, 2026	CVSS7.3v3.1	EPSS1.66%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-10279HIGH	Privilege Escalation in mlflow/mlflow In mlflow version 2.20.3, the temporary directory used for creating Python virtual environments is assigned insecure world-writable permissions (0o777). This vulnerability allows an attacker with write access to the `/tmp` directory to exploit a race condition and overwrite `.py` files in the virtual environment, leading to arbitrary code execution. The issue is resolved in version 3.4.0. CWE-379Feb 2, 2026	CVSS7.0v3.0	EPSS0.215%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-14279HIGH	DNS Rebinding Vulnerability in mlflow/mlflow MLFlow versions up to and including 3.4.0 are vulnerable to DNS rebinding attacks due to a lack of Origin header validation in the MLFlow REST server. This vulnerability allows malicious websites to bypass Same-Origin Policy protections and execute unauthorized calls against REST endpoints. An attacker can query, update, and delete experiments via the affected endpoints, leading to potential data exfiltration, destruction, or manipulation. The issue is resolved in version 3.5.0. CWE-346Jan 12, 2026	CVSS8.1v3.0	EPSS0.184%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-11200CRITICAL	MLflow Weak Password Requirements Authentication Bypass Vulnerability MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. The issue results from weak password requirements. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26916. CWE-521Oct 29, 2025	CVSS9.8v3.1	EPSS1.47%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX