MLflow has 51 CVEs on record between 2023 and 2026. Cadence is steady at roughly 8 per quarter. The busiest recent month was May 2026 with 5. The median CVSS is 8.1 (high), with 3 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-502 (3).

CVEs per month

Last 12 months, by publish date

1025/101125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/09

Exploited share: 0% vs 1% corpus
Median CVSS: 8.1
Publish → KEV: —
Last 90 days: 8 prev 10

Weakness classes

Products

MLflow 51

Follow MLflow:RSS feed Save a search →Embed badge ↗

Total CVEs

Critical

CISA KEV

Exploited

Worst active — by depth score

MLflow vulnerabilities

CVEs affecting MLflow, newest first. Open any entry for full detail, references, and exploit status.

51 CVEsRSS

CVE-2025-0453Medium· 5.9

CVEs per month

Weakness classes

Products

Worst active — by depth score

MLflow vulnerabilities

MLflow Uncontrolled Resource Consumption vulnerability

Undefined Behavior in mlflow

MLFlow unsafe deserialization

MLFlow unsafe deserialization

MLFlow improper input validation

MLFlow unsafe deserialization

MLFlow unsafe deserialization

MLFlow unsafe deserialization

MLFlow unsafe deserialization

MLFlow unsafe deserialization

MLFlow unsafe deserialization

MLFlow unsafe deserialization

mlflow vulnerable to Path Traversal

mlflow vulnerable to Path Traversal

mlflow Path Traversal vulnerability

mlflow vulnerable to Path Traversal

mlflow vulnerable to Path Traversal

MLflow Path Traversal Vulnerability

MLflow Local File Disclosure Vulnerability

mlflow Command Injection vulnerability

Information exposure in MLflow