L
Vendor security profile1 actively exploited CVEs
lfprojects
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs32
Critical9
CISA KEV1
Public exploit19
Patch rate%53
Avg. CVSS7.9
12-month vulnerability rate
0
2
1
5
7
3
5
4
4
1
0
0
CVE KEV
CVE severity distribution
32toplam CVE
Critical9 (28%)
High18 (56%)
Medium4 (13%)
Low1 (3%)
Patch and exploitation view
%53
Verified patch
%3
CISA KEV
%59
Public exploit
17Patch available
0Partial
0Workaround
0Vendor: no patch
15Unknown
Latest vulnerabilities
9.3
CVE-2026-64849 Actively exploited
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
M
Patch verifiedEPSS %10
8.1
CVE-2026-59950
Vulnerability in Lfprojects Mcp Python Sdk
L
Patch verifiedEPSS %0
7.6
CVE-2026-52870
Missing authorization in Lfprojects Mcp Python Sdk
L
Patch verifiedEPSS %0
7.1
CVE-2026-52869
Vulnerability in Lfprojects Mcp Python Sdk
L
Patch verifiedEPSS %1
8.1
CVE-2026-8147
Improper access control in Lfprojects Mlflow
L
Patch verifiedEPSS %1
8.8
CVE-2026-13484
Missing authorization in Lfprojects Mlflow
L
Patch status unknownEPSS %1
3.6
CVE-2026-10803
Broken cryptographic algorithm in Lfprojects Mlflow
L
Patch status unknownEPSS %0
9.1
CVE-2026-4035
Environment Variable Resolution Vulnerability in mlflow/mlflow
M
Patch verifiedEPSS %1
6.5
CVE-2026-3198
Improper access control in Lfprojects Mlflow
L
Patch status unknownEPSS %0
9.0
CVE-2026-2651
Missing authorization in Lfprojects Mlflow
L
Patch verifiedEPSS %1