Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 2 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,943All CVEsplus 19,118 rejected
- 383Last 24 hours2,817 in the last 7 days
- 16,800Last 30 days1,547 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 10 | 21 | 10 | 0 | 0 | 41 | 89 |
| 2025 | 0 | 3 | 3 | 1 | 0 | 7 | 48 |
| 2024 | 2 | 17 | 2 | 0 | 0 | 21 | 41 |
| 2023 | 12 | 5 | 2 | 0 | 0 | 19 | 20 |
| 2022 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-118628 | MLflow get-artifacts Server-Side Request Forgery Information Disclosure VulnerabilityMLflow · MLflow | High8.2 |
| CVE-2026-118627 | MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution VulnerabilityMLflow · MLflow | High7.8 |
| CVE-2026-118626 | MLflow Tracking Server Issues Missing Authorization Privilege Escalation VulnerabilityMLflow · MLflow | Medium5.4 |
| CVE-2026-118625 | MLflow Tracking Server Missing Authorization Privilege Escalation VulnerabilityMLflow · MLflow | Medium6.3 |
| CVE-2026-118624 | MLflow Tracking Server Jobs Missing Authorization Information Disclosure VulnerabilityMLflow · MLflow | Medium5.4 |
| CVE-2026-118623 | MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution VulnerabilityMLflow · MLflow | High7.8 |
| CVE-2026-116692 | MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modulesmlflow · mlflow | Critical9.8 |
| CVE-2026-116691 | MLflow CrewAI autologging records LLM provider API keys in logged trace spansmlflow · mlflow | Medium6.5 |
| CVE-2026-116690 | MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version sourcemlflow · mlflow | High7.5 |
| CVE-2026-115886 | MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpointsmlflow · mlflow | Medium6.5 |
| CVE-2026-53995 | MLflow 3.17.1 and prior Path Traversal via Trace ID APImlflow · mlflow | High8.8 |
| CVE-2026-96804 | CVE-2026-96804MLflow · MLflow | High8.8 |
| CVE-2026-96775 | MLflow dspy bypasses pickle deserialization controlMLflow · MLflow | High8.8 |
| CVE-2026-79721 | Code execution can occur in versions of the MLflow platform running version 0.0.1 or newer, enabling a maliciously crafted model artifact to execute arbitrary…mlflow · mlflow | High8.6 |
| CVE-2026-69146 | MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-authmlflow · mlflow | Medium6.5 |
| CVE-2026-69148 | MLflow: CreateModelVersion source validation does not check READ permission on referenced run_idmlflow · mlflow | High7.1 |
| CVE-2026-64849 | MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)Exploitedmlflow · mlflow | Critical9.3 |
| CVE-2026-71211 | mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpointmlflow · mlflow | High7.1 |
| CVE-2026-8147 | Authorization Bypass in mlflow/mlflowmlflow · mlflow/mlflow | High8.1 |
| CVE-2026-4035 | Environment Variable Resolution Vulnerability in mlflow/mlflowmlflow · mlflow/mlflow | Critical9.1 |
| CVE-2026-3198 | Improper Access Control in mlflow/mlflowmlflow · mlflow/mlflow | Medium6.5 |
| CVE-2026-2651 | Missing Authorization Validation in mlflow/mlflowmlflow · mlflow/mlflow | Critical9.0 |
| CVE-2026-2734 | Authorization Bypass in SearchModelVersions in mlflow/mlflowmlflow · mlflow/mlflow | Medium6.5 |
| CVE-2026-2611 | Improper Origin Validation in mlflow/mlflowmlflow · mlflow/mlflow | Critical9.6 |
| CVE-2026-4137 | Incomplete Fix for CVE-2025-10279: Insecure Temporary Directory Permissions in mlflow/mlflowmlflow · mlflow/mlflow | High7.0 |
| CVE-2026-2652 | Authentication Bypass in mlflow/mlflowmlflow · mlflow/mlflow | High8.6 |
| CVE-2026-2614 | Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflowmlflow · mlflow/mlflow | High7.5 |
| CVE-2026-2393 | Server-Side Request Forgery (SSRF) in mlflow/mlflowmlflow · mlflow/mlflow | High7.1 |
| CVE-2026-33866 | Authorization Bypass in MLflow AJAX EndpointMlflow · Mlflow | Medium5.3 |
| CVE-2026-33865 | Stored XSS via unsafe YAML parsing in MLflowMlflow · Mlflow | Medium5.1 |
| CVE-2026-0545 | Missing Authentication for Critical Function in mlflow/mlflowmlflow · mlflow/mlflow | Critical9.1 |
| CVE-2026-0596 | Command Injection in mlflow/mlflowmlflow · mlflow/mlflow | Critical9.6 |
| CVE-2025-15379 | Command Injection in mlflow/mlflowmlflow · mlflow/mlflow | Critical10.0 |
| CVE-2025-15036 | Path Traversal Vulnerability in mlflow/mlflowmlflow · mlflow/mlflow | Critical9.6 |
| CVE-2025-15381 | Unauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflowmlflow · mlflow/mlflow | High8.1 |
| CVE-2025-15031 | Path Traversal Vulnerability in mlflow/mlflowmlflow · mlflow/mlflow | High8.1 |
| CVE-2025-14287 | Command Injection in mlflow/mlflowmlflow · mlflow/mlflow | High7.5 |
| CVE-2026-2635 | MLflow Use of Default Password Authentication Bypass VulnerabilityMLflow · MLflow | Critical9.8 |
| CVE-2026-2033 | MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution VulnerabilityMLflow · MLflow | High8.1 |
| CVE-2025-10279 | Privilege Escalation in mlflow/mlflowmlflow · mlflow/mlflow | High7.0 |
| CVE-2025-14279 | DNS Rebinding Vulnerability in mlflow/mlflowmlflow · mlflow/mlflow | High8.1 |
| CVE-2025-11200 | MLflow Weak Password Requirements Authentication Bypass VulnerabilityMLflow · MLflow | High8.1 |
| CVE-2025-11201 | MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution VulnerabilityMLflow · MLflow | High8.1 |
| CVE-2025-0453 | Denial of Service through Batched Queries in GraphQL in mlflow/mlflowmlflow · mlflow/mlflow | Medium5.9 |
| CVE-2025-1474 | Weak Password Requirements in mlflow/mlflowmlflow · mlflow/mlflow | Low3.8 |
| CVE-2025-1473 | CSRF in mlflow/mlflowmlflow · mlflow/mlflow | Medium5.4 |
| CVE-2024-8859 | Path Traversal in mlflow/mlflowmlflow · mlflow/mlflow | High7.5 |
| CVE-2024-6838 | Uncontrolled Resource Consumption in mlflow/mlflowmlflow · mlflow/mlflow | Medium5.3 |
| CVE-2024-2928 | Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflowmlflow · mlflow/mlflow | High7.5 |
| CVE-2024-0520 | Remote Code Execution due to Full Controlled File Write in mlflow/mlflowmlflow · mlflow/mlflow | Critical10.0 |