Known Vulnerabilities for products from Lfprojects
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Lfprojects".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-44430 json | The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the Regi... | Not Provided | 2026-05-14 | 2026-05-15 |
| CVE-2026-44429 json | The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the publ... | Not Provided | 2026-05-14 | 2026-05-15 |
| CVE-2026-44428 json | The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.6, the clie... | Not Provided | 2026-05-14 | 2026-05-15 |
| CVE-2026-40090 json | Zarf is an Airgap Native Packager Manager for Kubernetes. Versions 0.23.0 through 0.74.1 contain an arbitrary file write vuln... | Not Provided | 2026-04-15 | 2026-04-23 |
| CVE-2026-35568 json | MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to 1.0.0, the java-sdk contains a... | Not Provided | 2026-04-07 | 2026-04-14 |
| CVE-2026-34742 json | The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not ena... | Not Provided | 2026-04-02 | 2026-07-15 |
| CVE-2026-34237 json | MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 0.83.0, 1.0.1, and 1.... | Not Provided | 2026-03-31 | 2026-06-09 |
| CVE-2026-33946 json | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the Ruby SDK's ... | Not Provided | 2026-03-27 | 2026-04-02 |
| CVE-2026-33866 json | MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint used to download saved model artifacts. Due to mi... | Not Provided | 2026-04-07 | 2026-04-20 |
| CVE-2026-33865 json | MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web... | Not Provided | 2026-04-07 | 2026-04-20 |
| CVE-2026-33252 json | The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted brow... | Not Provided | 2026-03-24 | 2026-04-15 |
| CVE-2026-27896 json | The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to ... | Not Provided | 2026-02-26 | 2026-07-15 |
| CVE-2026-27735 json | Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp-serv... | Not Provided | 2026-02-26 | 2026-04-14 |
| CVE-2026-27623 json | Valkey is a distributed key-value database. Starting in version 9.0.0 and prior to version 9.0.3, a malicious actor with netw... | Not Provided | 2026-02-23 | 2026-07-15 |
| CVE-2026-25536 json | MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25... | Not Provided | 2026-02-04 | 2026-07-15 |
| CVE-2026-21863 json | Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious actor with access ... | Not Provided | 2026-02-23 | 2026-07-15 |
| CVE-2026-13484 json | A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown f... | Not Provided | 2026-06-28 | 2026-07-01 |
| CVE-2026-10803 json | A flaw has been found in MLflow up to 3.10.0. This issue affects the function mlflow.data.digest_utils of the file mlflow/dat... | Not Provided | 2026-06-04 | 2026-06-04 |
| CVE-2026-8147 json | In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorizati... | Not Provided | 2026-07-02 | 2026-07-06 |
| CVE-2026-4137 json | In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in `mlflow/utils/file_utils.py` creates... | Not Provided | 2026-05-18 | 2026-06-02 |