[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2V8rsETb8BwFX75XkbaigYQAqpUD9D73R16LhhxfTkk":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":74,"kevVulnerabilities":131,"topProductsByCves":132,"seoMetadata":143,"meta":152},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":73},17547,"lfprojects",12,62,0,773,"2026-04-02","l",[16,22,28,33,38,41,46,51,56,60,65,69],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":21},103304,"mlflow",134,53,"2025-10-29",{"id":23,"product_name":24,"version_count":25,"cve_count":26,"kev_count":11,"last_cve_update":27},103298,"apptainer",20,2,"2023-07-25",{"id":29,"product_name":30,"version_count":31,"cve_count":26,"kev_count":11,"last_cve_update":32},103306,"valkey",21,"2025-10-03",{"id":34,"product_name":35,"version_count":26,"cve_count":36,"kev_count":11,"last_cve_update":37},103300,"cdo_local_uuid_utility",1,"2024-01-11",{"id":39,"product_name":40,"version_count":11,"cve_count":36,"kev_count":11,"last_cve_update":13},103301,"mcp_go_sdk",{"id":42,"product_name":43,"version_count":44,"cve_count":36,"kev_count":11,"last_cve_update":45},103303,"minder",83,"2024-02-26",{"id":47,"product_name":48,"version_count":49,"cve_count":36,"kev_count":11,"last_cve_update":50},103305,"modelina",146,"2023-01-26",{"id":52,"product_name":53,"version_count":54,"cve_count":36,"kev_count":11,"last_cve_update":55},103307,"vector_packet_processor",11,"2023-03-28",{"id":57,"product_name":58,"version_count":59,"cve_count":36,"kev_count":11,"last_cve_update":37},103299,"case_python_utilities",26,{"id":61,"product_name":62,"version_count":63,"cve_count":11,"kev_count":11,"last_cve_update":64},103308,"zarf",176,null,{"id":66,"product_name":67,"version_count":68,"cve_count":11,"kev_count":11,"last_cve_update":64},103302,"mcp_typescript_sdk",78,{"id":70,"product_name":71,"version_count":72,"cve_count":11,"kev_count":11,"last_cve_update":64},103297,"agentgateway",76,"Lfprojects is a technology vendor with 12 tracked products and 62 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[75,84,90,96,102,107,112,117,121,126],{"cveId":76,"description":77,"publishedDate":78,"cvssScore":79,"cvssVersion":80,"severity":81,"isKev":82,"epssScore":83},"CVE-2023-6909","Path Traversal: '\\..\\filename' in GitHub repository mlflow\u002Fmlflow prior to 2.9.2.","2023-12-18",7.5,"v3.1","High",false,0.89716,{"cveId":85,"description":86,"publishedDate":32,"cvssScore":87,"cvssVersion":80,"severity":88,"isKev":82,"epssScore":89},"CVE-2025-49844","Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.",9.9,"Critical",0.86767,{"cveId":91,"description":92,"publishedDate":93,"cvssScore":94,"cvssVersion":80,"severity":88,"isKev":82,"epssScore":95},"CVE-2023-3765","Absolute Path Traversal in GitHub repository mlflow\u002Fmlflow prior to 2.5.0.","2023-07-19",10,0.70736,{"cveId":97,"description":98,"publishedDate":99,"cvssScore":100,"cvssVersion":80,"severity":88,"isKev":82,"epssScore":101},"CVE-2023-1177","Path Traversal: '\\..\\filename' in GitHub repository mlflow\u002Fmlflow prior to 2.2.1.\n\n","2023-03-24",9.8,0.69468,{"cveId":103,"description":104,"publishedDate":105,"cvssScore":100,"cvssVersion":80,"severity":88,"isKev":82,"epssScore":106},"CVE-2023-6018","An attacker can overwrite any file on the server hosting MLflow without any authentication.","2023-11-16",0.47874,{"cveId":108,"description":109,"publishedDate":110,"cvssScore":79,"cvssVersion":80,"severity":81,"isKev":82,"epssScore":111},"CVE-2024-3848","A path traversal vulnerability exists in mlflow\u002Fmlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '#' character can be used to insert a path into the fragment, effectively skipping validation. This allows an attacker to construct a URL that, when processed, ignores the protocol scheme and uses the provided path for filesystem access. As a result, an attacker can read arbitrary files, including sensitive information such as SSH and cloud keys, by exploiting the way the application converts the URL into a filesystem path. The issue stems from insufficient validation of the fragment portion of the URL, leading to arbitrary file read through path traversal.","2024-05-16",0.43284,{"cveId":113,"description":114,"publishedDate":115,"cvssScore":79,"cvssVersion":80,"severity":81,"isKev":82,"epssScore":116},"CVE-2023-43472","An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API.","2023-12-05",0.36582,{"cveId":118,"description":119,"publishedDate":21,"cvssScore":100,"cvssVersion":80,"severity":88,"isKev":82,"epssScore":120},"CVE-2025-11201","MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of model file paths. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26921.",0.27133,{"cveId":122,"description":123,"publishedDate":124,"cvssScore":79,"cvssVersion":80,"severity":81,"isKev":82,"epssScore":125},"CVE-2024-2928","A Local File Inclusion (LFI) vulnerability was identified in mlflow\u002Fmlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '..\u002F'. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system, including sensitive files like '\u002Fetc\u002Fpasswd'. The vulnerability is a bypass to a previous patch that only addressed similar manipulation within the URI's query string, highlighting the need for comprehensive validation of all parts of a URI to prevent LFI attacks.","2024-06-06",0.21847,{"cveId":127,"description":128,"publishedDate":129,"cvssScore":100,"cvssVersion":80,"severity":88,"isKev":82,"epssScore":130},"CVE-2023-2780","Path Traversal: '\\..\\filename' in GitHub repository mlflow\u002Fmlflow prior to 2.3.1.","2023-05-17",0.06311,[],[133,134,135,136,137,138,139,140,141,142],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":21},{"id":23,"product_name":24,"version_count":25,"cve_count":26,"kev_count":11,"last_cve_update":27},{"id":29,"product_name":30,"version_count":31,"cve_count":26,"kev_count":11,"last_cve_update":32},{"id":34,"product_name":35,"version_count":26,"cve_count":36,"kev_count":11,"last_cve_update":37},{"id":39,"product_name":40,"version_count":11,"cve_count":36,"kev_count":11,"last_cve_update":13},{"id":42,"product_name":43,"version_count":44,"cve_count":36,"kev_count":11,"last_cve_update":45},{"id":47,"product_name":48,"version_count":49,"cve_count":36,"kev_count":11,"last_cve_update":50},{"id":52,"product_name":53,"version_count":54,"cve_count":36,"kev_count":11,"last_cve_update":55},{"id":57,"product_name":58,"version_count":59,"cve_count":36,"kev_count":11,"last_cve_update":37},{"id":61,"product_name":62,"version_count":63,"cve_count":11,"kev_count":11,"last_cve_update":64},{"title":144,"metaDescription":145,"keywords":146,"structuredData":147},"Lfprojects - Security Vulnerabilities & Analysis | EdgeProtect","Comprehensive security analysis for Lfprojects covering 12 products with 62 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Lfprojects vulnerabilities, Lfprojects security, Lfprojects CVE, Lfprojects threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":148,"@type":149,"name":150,"description":145,"url":151},"https:\u002F\u002Fschema.org","Organization","Lfprojects","https:\u002F\u002Fedgeprotect.io\u002Fvendors\u002Flfprojects",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":153,"apiVersion":154},"2026-10-28T18:09:57.673Z","3.0"]