vendor1 exploited in the wild

Lfprojects

15 CVEs published in the last four months. Exploited flaws first.

Critical4

High11

Medium0

Exploited (KEV)1

Patch these first

CVE	CVSS	Severity	Product	Summary	Published
CVE-2026-64849exploited	9.3	critical	mlflow	MLflow is an open source AI engineering platform for agents, large language models, and machine learning models.	19d ago

All recent CVEs

CVE	CVSS	Severity	Product	Summary	Published
CVE-2026-2611	9.6	critical	mlflow	In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoi	109d ago
CVE-2026-64849exploited	9.3	critical	mlflow	MLflow is an open source AI engineering platform for agents, large language models, and machine learning models.	19d ago
CVE-2025-15031	9.1	critical	mlflow	A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of	171d ago
CVE-2026-2651	9	critical	mlflow	A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints whe	103d ago
CVE-2025-14287	8.8	high	mlflow	A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the `mlflow/sage	173d ago
CVE-2026-2652	8.6	high	mlflow	A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes	114d ago
CVE-2026-8147	8.1	high	mlflow	In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper a	65d ago
CVE-2026-59950	8.1	high	mcp python sdk	The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP).	52d ago
CVE-2026-4137	7.8	high	mlflow	In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in `mlflow/utils/file_utils.p	110d ago
CVE-2026-4035	7.7	high	mlflow	A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI	94d ago
CVE-2026-52870	7.6	high	mcp python sdk	The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP).	52d ago
CVE-2026-2614	7.5	high	mlflow	A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3	117d ago
CVE-2026-52869	7.1	high	mcp python sdk	The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP).	52d ago
CVE-2026-2393	7.1	high	mlflow	A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0.	117d ago
CVE-2026-33252	7.1	high	mcp go sdk	The Go MCP SDK used Go's standard encoding/json.	166d ago

Filter the full tracker by Lfprojects →