Veille CVE

Septembre 2026

3 CVE

Critique 0 Élevée 3 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « mlflow » ✕
  1. CVE-2026-96804 8.8 Élevée

    MLflow

    MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control entirely in _load_model(), which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.

  2. CVE-2026-96775 8.8 Élevée

    MLflow

    MLflow's dspy flavor, versions >= 2.0, applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control only when the model_path ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.

  3. CVE-2026-79721 8.6 Élevée

    mlflow

    Code execution can occur in versions of the MLflow platform running version 0.0.1 or newer, enabling a maliciously crafted model artifact to execute arbitrary code on an end user's system when loaded by the project.