# Lfprojects Mlflow


- [CVE-2026-64849](https://insights.sbomify.com/CVE-2026-64849/): MLflow Server-Side Request Forgery (critical 9.3, exploited in the wild)
- [CVE-2025-15379](https://insights.sbomify.com/CVE-2025-15379/): Command Injection in mlflow/mlflow (critical 10.0)
- [CVE-2024-0520](https://insights.sbomify.com/CVE-2024-0520/): Remote Code Execution due to Full Controlled File Write in mlflow/mlflow (critical 10.0)
- [CVE-2023-6977](https://insights.sbomify.com/CVE-2023-6977/): Path Traversal: '\..\filename' (critical 10.0)
- [CVE-2023-6709](https://insights.sbomify.com/CVE-2023-6709/): Improper Neutralization of Special Elements Used in a Template Engine in mlflow/mlflow (critical 10.0)
- [CVE-2023-6015](https://insights.sbomify.com/CVE-2023-6015/): MLflow Arbitrary File Upload (critical 10.0)
- [CVE-2023-6018](https://insights.sbomify.com/CVE-2023-6018/): MLflow Arbitrary File Write (critical 10.0)
- [CVE-2023-3765](https://insights.sbomify.com/CVE-2023-3765/): Absolute Path Traversal in mlflow/mlflow (critical 10.0)
- [CVE-2023-2356](https://insights.sbomify.com/CVE-2023-2356/): Relative Path Traversal in mlflow/mlflow (critical 10.0)
- [CVE-2023-6975](https://insights.sbomify.com/CVE-2023-6975/): Path Traversal: '\..\filename' (critical 9.8)
- [CVE-2023-2780](https://insights.sbomify.com/CVE-2023-2780/): Path Traversal: '\..\filename' in mlflow/mlflow (critical 9.8)
- [CVE-2026-2611](https://insights.sbomify.com/CVE-2026-2611/): Improper Origin Validation in mlflow/mlflow (critical 9.6)

---
From sbomify Insights: https://insights.sbomify.com/products/lfprojects/mlflow/