ZDI-26-847: MLflow AI Gateway Server-Side Request Forgery Information Disclosure Vulnerability 30/10/2026
ZDI-26-845: MLflow Statsmodels _load_model Deserialization of Untrusted Data Remote Code Execution Vulnerability 30/10/2026
ZDI-26-844: MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability 30/10/2026
ZDI-26-847: MLflow AI Gateway Server-Side Request Forgery Information Disclosure Vulnerability This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of MLflow. Authentication is required to exploit... 30/10/2026 Zero-Day Initiative
ZDI-26-846: MLflow Webhook Server-Side Request Forgery Vulnerability This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of MLflow. Authentication is required to exploit... 30/10/2026 Zero-Day Initiative
ZDI-26-845: MLflow Statsmodels _load_model Deserialization of Untrusted Data Remote Code Execution Vulnerability This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit... 30/10/2026 Zero-Day Initiative
ZDI-26-844: MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is not required to exploit... 30/10/2026 Zero-Day Initiative
ZDI-26-843: MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit... 30/10/2026 Zero-Day Initiative
ZDI-26-842: MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability.... 30/10/2026 Zero-Day Initiative
ZDI-26-841: MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability.... 30/10/2026 Zero-Day Initiative
ZDI-26-840: MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is required to exploit this... 30/10/2026 Zero-Day Initiative
ZDI-26-839: MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit... 30/10/2026 Zero-Day Initiative
ZDI-26-838: FreeBSD Kernel TTY Race Condition Local Privilege Escalation Vulnerability This vulnerability allows local attackers to escalate privileges on affected installations of FreeBSD Kernel. An attacker must first obtain the... 30/10/2026 Zero-Day Initiative
