mlflow MLflow

Name: mlflow MLflow
Brand: mlflow

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

2critical0high2medium0low

updated 2026-10-27

vulnerabilities (10)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-64849US	—OT critical	10.0% (96th)	KEV	no fix	2026-08-17	≤ < 3.15.0
CVE-2025-11201US	critical9.8	26.3% (98th)	Exploit	no fix	2025-10-29	≤ 2.21.3
CVE-2026-71211US	—	0.29% (21st)	Exploit	no fix	2026-08-05	≤ 0 ≤3.14.0
CVE-2026-2033US	—	1.85% (79th)	—	no fix	2026-02-20	≤ 3.1.1 and 5b9c01925c2e2a8cf0951f155a6a468ff99cfe0f
CVE-2025-11200US	critical9.8	1.44% (73rd)	—	no fix	2025-10-29	≤ 2.21.0
CVE-2026-2635US	—OT elevated	1.08% (65th)	—	no fix	2026-02-20	≤ 3.4.0
CVE-2026-69146US	—OT elevated	0.39% (33rd)	—	no fix	2026-08-17	≤ < 3.15.0
CVE-2026-69148US	—OT elevated	0.37% (31st)	—	no fix	2026-08-17	≤ < 3.15.0
CVE-2026-33866US	medium4.3OT elevated	0.36% (30th)	—	no fix	2026-04-07	≤ 0 ≤3.10.1
CVE-2026-33865US	medium5.4	0.22% (12th)	—	no fix	2026-04-07	≤ 0 ≤3.10.1

The flaw types (CWEs) most of these CVEs share.

CWE-862Missing Authorization3 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2 CVEs
CWE-918Server-Side Request Forgery (SSRF)2 CVEs
CWE-1393Use of Default Password1 CVEs
CWE-521Weak Password Requirements1 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1 CVEs
CWE-798Use of Hard-coded Credentials1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.