Patchfirst: mlflow vulnerabilitieshttps://patchfirst.co/vendor/mlflow/New and newly exploited mlflow CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMTCVE-2026-116690: MLflow is an open source AI engineering platform for agents, large language models, and machine learning modelshttps://patchfirst.co/cve/CVE-2026-116690/CVE-2026-116690Tue, 27 Oct 2026 00:00:00 GMTmlflow · mlflow. Not in CISA KEV. EPSS 0.6% (higher than 46.6% of CVEs). CVSS 7.5 HIGH. Priority 60.9 of 100.CVE-2026-116692: MLflow is an open source AI engineering platform for agents, large language models, and machine learning modelshttps://patchfirst.co/cve/CVE-2026-116692/CVE-2026-116692Tue, 27 Oct 2026 00:00:00 GMTmlflow · mlflow. Not in CISA KEV. EPSS 0.7% (higher than 53.3% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 23.9 of 100.public-exploitCVE-2026-115886: MLflow is an open source AI engineering platform for agents, large language models, and machine learning modelshttps://patchfirst.co/cve/CVE-2026-115886/CVE-2026-115886Fri, 23 Oct 2026 00:00:00 GMTmlflow · mlflow. Not in CISA KEV. EPSS 0.7% (higher than 52.2% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. Priority 66.8 of 100.public-exploit[KEV] CVE-2026-64849: MLflow Server-Side Request Forgery Vulnerabilityhttps://patchfirst.co/cve/CVE-2026-64849/CVE-2026-64849#kevWed, 19 Aug 2026 00:00:00 GMTMLflow · MLflow. In CISA KEV since 2026-08-19. ENISA EUVD lists it as exploited. EPSS 10.0% (higher than 95.6% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1090 Proxy. Priority 78.6 of 100.kevpublic-exploitT1190T1090CVE-2026-2652: Authentication Bypass in mlflow/mlflowhttps://patchfirst.co/cve/CVE-2026-2652/CVE-2026-2652Fri, 15 May 2026 00:00:00 GMTmlflow · mlflow/mlflow. Not in CISA KEV. EPSS 20.8% (higher than 97.5% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. Priority 77.6 of 100.public-exploitCVE-2026-2614: Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflowhttps://patchfirst.co/cve/CVE-2026-2614/CVE-2026-2614Mon, 11 May 2026 00:00:00 GMTmlflow · mlflow/mlflow. Not in CISA KEV. EPSS 3.7% (higher than 89.7% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. Priority 75.1 of 100.public-exploitCVE-2025-11201: MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerabilityhttps://patchfirst.co/cve/CVE-2025-11201/CVE-2025-11201Wed, 29 Oct 2025 00:00:00 GMTMLflow · MLflow. Not in CISA KEV. EPSS 26.3% (higher than 98% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. Priority 76.0 of 100.public-exploitCVE-2024-3848: Path Traversal Bypass in mlflow/mlflowhttps://patchfirst.co/cve/CVE-2024-3848/CVE-2024-3848Thu, 16 May 2024 00:00:00 GMTmlflow · mlflow/mlflow. Not in CISA KEV. EPSS 43.3% (higher than 98.7% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. Priority 75.0 of 100.public-exploitCVE-2023-6909: Path Traversal: '\..\filename' in mlflow/mlflowhttps://patchfirst.co/cve/CVE-2023-6909/CVE-2023-6909Mon, 18 Dec 2023 00:00:00 GMTmlflow · mlflow/mlflow. Not in CISA KEV. EPSS 89.7% (higher than 99.79% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. Priority 70.2 of 100.public-exploitCVE-2023-3765: Absolute Path Traversal in mlflow/mlflowhttps://patchfirst.co/cve/CVE-2023-3765/CVE-2023-3765Wed, 19 Jul 2023 00:00:00 GMTmlflow · mlflow/mlflow. Not in CISA KEV. EPSS 67.5% (higher than 99.31% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. Priority 31.9 of 100.public-exploitCVE-2023-1177: Path Traversal: '\..\filename' in mlflow/mlflowhttps://patchfirst.co/cve/CVE-2023-1177/CVE-2023-1177Fri, 24 Mar 2023 00:00:00 GMTmlflow · mlflow/mlflow. Not in CISA KEV. EPSS 69.7% (higher than 99.37% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. Priority 66.4 of 100.public-exploit