https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T09:40:27.923904+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-mlflow-2025-14279 BIT-mlflow-2025-14279 — DNS Rebinding Vulnerability in mlflow/mlflow 2026-10-09T09:40:28.001020+00:00

Affected: Bitnami: mlflow

MLFlow versions up to and including 3.4.0 are vulnerable to DNS rebinding attacks due to a lack of Origin header validation in the MLFlow REST server. This vulnerability allows malicious websites to bypass Same-Origin Policy protections and execute unauthorized calls against REST endpoints. An attacker can query, update, and delete experiments via the affected endpoints, leading to potential data exfiltration, destruction, or manipulation. The issue is resolved in version 3.5.0.

 https://cve.radiocsirt.org/vuln/euvd-2026-265373 EUVD-2026-265373 2026-10-09T09:40:28.001088+00:00 EUVD-2026-265373 https://cve.radiocsirt.org/vuln/fkie_cve-2025-14279 fkie_cve-2025-14279 2026-10-09T09:40:28.001105+00:00

MLFlow versions up to and including 3.4.0 are vulnerable to DNS rebinding attacks due to a lack of Origin header validation in the MLFlow REST server. This vulnerability allows malicious websites to bypass Same-Origin Policy protections and execute unauthorized calls against REST endpoints. An attacker can query, update, and delete experiments via the affected endpoints, leading to potential data exfiltration, destruction, or manipulation. The issue is resolved in version 3.5.0.

 https://cve.radiocsirt.org/vuln/ghsa-pgqp-8h46-6x4j GHSA-pgqp-8h46-6x4j — MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validation 2026-10-09T09:40:28.001132+00:00

Affected: PyPI: mlflow

MLFlow versions up to and including 3.4.0 are vulnerable to DNS rebinding attacks due to a lack of Origin header validation in the MLFlow REST server. This vulnerability allows malicious websites to bypass Same-Origin Policy protections and execute unauthorized calls against REST endpoints. An attacker can query, update, and delete experiments via the affected endpoints, leading to potential data exfiltration, destruction, or manipulation. The issue is resolved in version 3.5.0.

 https://cve.radiocsirt.org/vuln/pysec-2026-1656 PYSEC-2026-1656 — MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validation 2026-10-09T09:40:28.001155+00:00

Affected: PyPI: mlflow

MLFlow versions up to and including 3.4.0 are vulnerable to DNS rebinding attacks due to a lack of Origin header validation in the MLFlow REST server. This vulnerability allows malicious websites to bypass Same-Origin Policy protections and execute unauthorized calls against REST endpoints. An attacker can query, update, and delete experiments via the affected endpoints, leading to potential data exfiltration, destruction, or manipulation. The issue is resolved in version 3.5.0.