How many CVEs does lfprojects have?

lfprojects has 115 published CVE records since 2022, including 62 in the last two years.

How many lfprojects CVEs are in CISA KEV?

None of lfprojects's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which lfprojects products have the most CVEs?

The lfprojects products with the most published CVEs are MLflow, valkey, model context protocol servers, mcp python sdk, mcp go sdk.

What are the most common weakness types in lfprojects CVEs?

lfprojects's CVEs most often map to these CWE weakness types: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-29 (Path Traversal: '\..\filename'), CWE-502 (Deserialization of Untrusted Data), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')).

Are there public exploits for lfprojects vulnerabilities?

Yes — 61 of lfprojects's CVEs have a known public exploit.

How many critical lfprojects vulnerabilities are there?

lfprojects has 20 critical and 69 high-severity CVEs.

What is the average severity of lfprojects CVEs?

The average CVSS base score across lfprojects's scored CVEs is 7.6.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

115 CVEs

lfprojects Vulnerabilities

Name: lfprojects vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for lfprojects.

115

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

61

Public exploits

PoC or exploit code

7.6

Avg CVSS

2022–2026

Overview

lfprojects has 115 published CVE records since 2022, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 61 have a known public exploit. The average CVSS base score across scored CVEs is 7.6.

This page aggregates every publicly disclosed vulnerability (CVE) affecting lfprojects products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on lfprojects's vulnerability posture, as a share of its 115 published CVEs.

Average CVSS: 7.6
Critical / high: 77%
Actively exploited (KEV): 0%
Public exploit available: 53%
Patch available: 90%

Severity and exploitation

How the CVSS severity of lfprojects's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical20

High69

Medium22

Low4

In CISA’s Known Exploited Vulnerabilities catalog

0

None of lfprojects's CVEs are currently listed in CISA's KEV catalog.

Public exploits

61

61 of lfprojects's CVEs have a known public exploit available.

Most affected products

The lfprojects products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in lfprojects CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish lfprojects CVE records.

Disclosure activity by year

How many lfprojects CVEs were published each year.

2022

1

2023

25

2024

27

2025

17

2026

45

Latest lfprojects CVEs

The most recently disclosed vulnerabilities affecting lfprojects.

MCP Python SDK: WebSocket server transport does not support Host/Origin validation
CWE-346
High · CVSS 7.6
EPSS 0.1%2026-07-15
MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
CWE-862
High · CVSS 7.6
EPSS 0.2%2026-07-15
MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
CWE-639
High · CVSS 7.1
EPSS 0.3%2026-07-15
Authorization Bypass in mlflow/mlflow
CWE-284
High · CVSS 8.1
EPSS 0.4%2026-07-02
MLflow Experiment-scoped Label Schema CRUD API authorization
CWE-862
Low · CVSS 2.3
EPSS 0.3%2026-06-28
MLflow Dataset Digest Computation digest_utils.py mlflow.data.digest_utils weak hash
CWE-328
Low · CVSS 2.0
EPSS 0.1%2026-06-04
Environment Variable Resolution Vulnerability in mlflow/mlflow
CWE-201
High · CVSS 7.7
EPSS 0.4%2026-06-03
Improper Access Control in mlflow/mlflow
CWE-284
Medium · CVSS 6.5
EPSS 0.2%2026-06-02
Missing Authorization Validation in mlflow/mlflow
CWE-862
Critical · CVSS 9.0
EPSS 0.3%2026-05-25
Authorization Bypass in SearchModelVersions in mlflow/mlflow
CWE-284
Medium · CVSS 6.5
EPSS 0.4%2026-05-21
Improper Origin Validation in mlflow/mlflow
CWE-346
Critical · CVSS 9.6
EPSS 0.4%2026-05-19
Incomplete Fix for CVE-2025-10279: Insecure Temporary Directory Permissions in mlflow/mlflow
CWE-378
High · CVSS 7.8
EPSS 0.2%2026-05-18

Track new lfprojects CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor lfprojects CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

macromedia116 CVEs Insteon115 CVEs mervinpraison115 CVEs piwigo115 CVEs SeaCMS115 CVEs WPChill115 CVEs codepeople114 CVEs GStreamer114 CVEs

Browse all vendors

Frequently asked questions

Common questions about lfprojects vulnerabilities.

How many CVEs does lfprojects have?: lfprojects has 115 published CVE records since 2022, including 62 in the last two years.
How many lfprojects CVEs are in CISA KEV?: None of lfprojects's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which lfprojects products have the most CVEs?: The lfprojects products with the most published CVEs are MLflow, valkey, model context protocol servers, mcp python sdk, mcp go sdk.
What are the most common weakness types in lfprojects CVEs?: lfprojects's CVEs most often map to these CWE weakness types: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-29 (Path Traversal: '\..\filename'), CWE-502 (Deserialization of Untrusted Data), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')).
Are there public exploits for lfprojects vulnerabilities?: Yes — 61 of lfprojects's CVEs have a known public exploit.
How many critical lfprojects vulnerabilities are there?: lfprojects has 20 critical and 69 high-severity CVEs.
What is the average severity of lfprojects CVEs?: The average CVSS base score across lfprojects's scored CVEs is 7.6.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track lfprojects vulnerabilities

Monitor new lfprojects vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing