Known Vulnerabilities for products from Lfprojects
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Lfprojects".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-40090 json | Zarf is an Airgap Native Packager Manager for Kubernetes. Versions 0.23.0 through 0.74.1 contain an arbitrary file write vuln... | Not Provided | 2026-04-15 | 2026-04-23 |
| CVE-2026-35568 json | MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to 1.0.0, the java-sdk contains a... | Not Provided | 2026-04-07 | 2026-04-14 |
| CVE-2026-34742 json | The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not ena... | Not Provided | 2026-04-02 | 2026-04-03 |
| CVE-2026-33946 json | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the Ruby SDK's ... | Not Provided | 2026-03-27 | 2026-04-02 |
| CVE-2026-33866 json | MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint used to download saved model artifacts. Due to mi... | Not Provided | 2026-04-07 | 2026-04-20 |
| CVE-2026-33865 json | MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web... | Not Provided | 2026-04-07 | 2026-04-20 |
| CVE-2026-33252 json | The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted brow... | Not Provided | 2026-03-24 | 2026-04-15 |
| CVE-2026-27896 json | The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to ... | Not Provided | 2026-02-26 | 2026-04-14 |
| CVE-2026-27735 json | Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp-serv... | Not Provided | 2026-02-26 | 2026-04-14 |
| CVE-2026-0596 json | A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`. The `model_uri` i... | Not Provided | 2026-03-31 | 2026-04-14 |
| CVE-2026-0545 json | In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization... | Not Provided | 2026-04-03 | 2026-04-21 |
| CVE-2025-68145 json | In mcp-server-git versions prior to 2025.12.17, when the server is started with the --repository flag to restrict operations ... | Not Provided | 2025-12-17 | 2026-04-14 |
| CVE-2025-68144 json | In mcp-server-git versions prior to 2025.12.17, the git_diff and git_checkout functions passed user-controlled arguments dire... | Not Provided | 2025-12-17 | 2026-04-14 |
| CVE-2025-68143 json | Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp-serv... | Not Provided | 2025-12-17 | 2026-04-14 |
| CVE-2025-15381 json | In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protec... | Not Provided | 2026-03-27 | 2026-04-28 |
| CVE-2025-15379 json | A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_insta... | Not Provided | 2026-03-30 | 2026-04-28 |
| CVE-2025-15036 json | A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artifact_c... | Not Provided | 2026-03-30 | 2026-04-28 |
| CVE-2025-14287 json | A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the `mlflow/sagemaker/__ini... | Not Provided | 2026-03-16 | 2026-04-14 |
| CVE-2025-14279 json | MLFlow versions up to and including 3.4.0 are vulnerable to DNS rebinding attacks due to a lack of Origin header validation i... | Not Provided | 2026-01-12 | 2026-04-14 |
| CVE-2025-10279 json | In mlflow version 2.20.3, the temporary directory used for creating Python virtual environments is assigned insecure world-wr... | Not Provided | 2026-02-02 | 2026-04-14 |