MLflow

Records176All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical24CVSS 9.0–10.0

CVSS high100CVSS 7.0–8.9

Exploited now

MLflow records in CISA KEV

TI-2026-46366 MLflow Server-Side Request Forgery Vulnerability CRITICAL 97KEV 2026-08-19

Components

Products in the NVD configurations · select one to filter the records

Mlflow 77 records CRITICAL Valkey 5 records HIGH Mcp Python Sdk 4 records LOW Model Context Protocol Servers 4 records MEDIUM Apptainer 3 records LOW Mcp Go Sdk 3 records LOW Mcp Registry 3 records MEDIUM Mcp Typescript Sdk 3 records HIGH

Records

3 records in Mcp Typescript Sdk · all components

TI-2026-00421 CVE-2026-0621 · GHSA-8r9q-7v3j-jr4g

MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoS

HIGH 77

Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00438 Published 2026-01-05 Fixed in 1.25.2 CWE-1333

TI-2025-40850 CVE-2025-66414 · GHSA-w48q-cv73-mx4w

DNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on Localhost

LOW 36

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients.

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.00544 Published 2025-12-02 Fixed in 1.24.0 CWE-1188

TI-2026-20645 CVE-2026-25536 · GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

LOW 31

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00293 Published 2026-02-04 Fixed in 1.26.0 CWE-362

Open these records in search →