https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 19:40:24 +0000 https://cve.radiocsirt.org/vuln/bit-mlflow-2026-33865 <p><strong>Affected:</strong> Bitnami: mlflow</p> <p>MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attacker can upload a malicious MLmodel file containing a payload that executes when another user views the artifact in the UI. This allows actions such as session hijacking or performing operations on behalf of the victim.</p> <p>This issue affects MLflow version through 3.10.1</p> <p><strong>Affected:</strong> Bitnami: mlflow</p> <p>MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attacker can upload a malicious MLmodel file containing a payload that executes when another user views the artifact in the UI. This allows actions such as session hijacking or performing operations on behalf of the victim.</p> <p>This issue affects MLflow version through 3.10.1</p> https://cve.radiocsirt.org/vuln/bit-mlflow-2026-33865 https://cve.radiocsirt.org/vuln/euvd-2026-291226 EUVD-2026-291226 https://cve.radiocsirt.org/vuln/euvd-2026-291226 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33865 <p>MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attacker can upload a malicious MLmodel file containing a payload that executes when another user views the artifact in the UI. This allows actions such as session hijacking or performing operations on behalf of the victim.</p> <p>This issue affects MLflow version through 3.10.1</p> <p>MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attacker can upload a malicious MLmodel file containing a payload that executes when another user views the artifact in the UI. This allows actions such as session hijacking or performing operations on behalf of the victim.</p> <p>This issue affects MLflow version through 3.10.1</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33865 https://cve.radiocsirt.org/vuln/ghsa-fh64-r2vc-xvhr <p><strong>Affected:</strong> PyPI: mlflow</p> <p>MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attacker can upload a malicious MLmodel file containing a payload that executes when another user views the artifact in the UI. This allows actions such as session hijacking or performing operations on behalf of the victim.</p> <p>This issue affects MLflow version through 3.10.1</p> <p><strong>Affected:</strong> PyPI: mlflow</p> <p>MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attacker can upload a malicious MLmodel file containing a payload that executes when another user views the artifact in the UI. This allows actions such as session hijacking or performing operations on behalf of the victim.</p> <p>This issue affects MLflow version through 3.10.1</p> https://cve.radiocsirt.org/vuln/ghsa-fh64-r2vc-xvhr https://cve.radiocsirt.org/vuln/pysec-2026-93 <p><strong>Affected:</strong> PyPI: mlflow</p> <p>MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attacker can upload a malicious MLmodel file containing a payload that executes when another user views the artifact in the UI. This allows actions such as session hijacking or performing operations on behalf of the victim.</p> <p>This issue affects MLflow version through 3.10.1</p> <p><strong>Affected:</strong> PyPI: mlflow</p> <p>MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attacker can upload a malicious MLmodel file containing a payload that executes when another user views the artifact in the UI. This allows actions such as session hijacking or performing operations on behalf of the victim.</p> <p>This issue affects MLflow version through 3.10.1</p> https://cve.radiocsirt.org/vuln/pysec-2026-93