lfprojects has 13 CVEs on record between 2025 and 2026. 1 was published in the last 90 days. The busiest recent month was March 2026 with 4. The median CVSS is 7.8 (high), with 5 rated critical. 8% have been exploited in the wild, in line with the corpus average. The most common weakness class is CWE-22 (3). Most affected products: mlflow (8), mcp_typescript_sdk (2), model_context_protocol_servers (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 8% vs 1% corpus
- Median CVSS
- 7.8
- Publish → KEV
- —(1)
- Last 90 days
- 1 prev 2
Weakness classes
Products
- mlflow 8
- mcp_typescript_sdk 2
- model_context_protocol_servers 2
- mcp_java_sdk 1
Worst active — by depth score
CVE-2026-64849Critical· 9.3MLflow is an open source AI engineering platform for agents, large language models, and machine learning models78CVE-2026-0545Critical· 9.8In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled67CVE-2026-0596High· 7.8A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`55CVE-2025-15379Critical· 10.0A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function55CVE-2026-2614High· 7.5A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem54
lfprojects vulnerabilities
CVEs affecting lfprojects, newest first. Open any entry for full detail, references, and exploit status.
13 CVEsRSS
CVE-2026-64849Critical· 9.3CISA KEVPoCMLflow is an open source AI engineering platform for agents, large language models, and machine learning models
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_…
CVE-2026-2611Critical· 9.6In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints
In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact wit…
CVE-2026-2614High· 7.5PoCA vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem
A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue…
CVE-2026-33865Medium· 5.4PoCMLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface
MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attacker can upload a malicious MLmodel file containing a payload that executes whe…
CVE-2026-0545Critical· 9.8PoCIn mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled
In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled. This vulnerability affects the latest version of the repository. If job e…
CVE-2026-34237Medium· 6.1MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients
MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 0.83.0, 1.0.1, and 1.1.1, there is a hardcoded wildcard CORS vulnerability. This issue has been patched in versions 0.83.0, 1.0.1, an…
CVE-2026-0596High· 7.8PoCA command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`
A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`. The `model_uri` is embedded directly into a shell command executed via `bash -c` without proper sanitization. If the `model_uri` …
CVE-2025-15379Critical· 10.0A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function
A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function. When deploying a model with `env_manager=LOCAL`, MLflow reads dependen…
CVE-2025-15381High· 7.1In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators
In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with `NO_PERMISSIONS` on the e…
CVE-2026-25536High· 7.1MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multi…
CVE-2026-0621High· 7.5PoCAnthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns
Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated …
CVE-2025-68145Critical· 9.1In mcp-server-git versions prior to 2025.12.17, when the server is started with the --repository flag to restrict operations to a specific repository path, it did not validate that repo_path arguments in subsequent tool calls were actual…
In mcp-server-git versions prior to 2025.12.17, when the server is started with the --repository flag to restrict operations to a specific repository path, it did not validate that repo_path arguments in subsequent tool calls were actual…
CVE-2025-68143High· 8.8Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP)
Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp-server-git versions prior to 2025.9.25, the git_init tool accepted arbitrary filesystem paths and created Git reposi…