ZDI-26-850: Microsoft Qlib MLflowRecorder Deserialization of Untrusted Data Remote Code Execution Vulnerability 03/11/2026
ZDI-26-849: Microsoft Qlib RestrictedUnpickler Deserialization of Untrusted Data Remote Code Execution Vulnerability 03/11/2026
ZDI-26-848: Microsoft Qlib StaticDataLoader Deserialization of Untrusted Data Remote Code Execution Vulnerability 03/11/2026
ZDI-26-847: MLflow AI Gateway Server-Side Request Forgery Information Disclosure Vulnerability 30/10/2026
ZDI-26-850: Microsoft Qlib MLflowRecorder Deserialization of Untrusted Data Remote Code Execution Vulnerability This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Qlib. User interaction is required to... 03/11/2026 Zero-Day Initiative
ZDI-26-849: Microsoft Qlib RestrictedUnpickler Deserialization of Untrusted Data Remote Code Execution Vulnerability This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Qlib. User interaction is required to... 03/11/2026 Zero-Day Initiative
ZDI-26-848: Microsoft Qlib StaticDataLoader Deserialization of Untrusted Data Remote Code Execution Vulnerability This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Qlib. User interaction is required to... 03/11/2026 Zero-Day Initiative
ZDI-26-847: MLflow AI Gateway Server-Side Request Forgery Information Disclosure Vulnerability This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of MLflow. Authentication is required to exploit... 30/10/2026 Zero-Day Initiative
ZDI-26-846: MLflow Webhook Server-Side Request Forgery Vulnerability This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of MLflow. Authentication is required to exploit... 30/10/2026 Zero-Day Initiative
ZDI-26-845: MLflow Statsmodels _load_model Deserialization of Untrusted Data Remote Code Execution Vulnerability This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit... 30/10/2026 Zero-Day Initiative
ZDI-26-844: MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is not required to exploit... 30/10/2026 Zero-Day Initiative
ZDI-26-843: MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit... 30/10/2026 Zero-Day Initiative
ZDI-26-842: MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability.... 30/10/2026 Zero-Day Initiative
ZDI-26-841: MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability.... 30/10/2026 Zero-Day Initiative
