https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 19 Aug 2026 19:59:30 +0000 https://vulnerability.circl.lu/sighting/5a36664e-1d7c-493f-ae6f-b7ac6e2f652d/export {"uuid": "5a36664e-1d7c-493f-ae6f-b7ac6e2f652d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mthil7nmgd2u", "content": "MLflow has an unauthenticated SSRF (CVE-2026-64849, CVSS 9.3) that reaches cloud metadata and returns the response, so it reads your instance credentials.\n\nEvery version before 3.15.0 is affected. Now on CISA's KEV list.\n\nPatch to 3.15.0 and enforce IMDSv2.", "creation_timestamp": "2026-08-19T19:44:41.593709Z"} {"uuid": "5a36664e-1d7c-493f-ae6f-b7ac6e2f652d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mthil7nmgd2u", "content": "MLflow has an unauthenticated SSRF (CVE-2026-64849, CVSS 9.3) that reaches cloud metadata and returns the response, so it reads your instance credentials.\n\nEvery version before 3.15.0 is affected. Now on CISA's KEV list.\n\nPatch to 3.15.0 and enforce IMDSv2.", "creation_timestamp": "2026-08-19T19:44:41.593709Z"} https://vulnerability.circl.lu/sighting/5a36664e-1d7c-493f-ae6f-b7ac6e2f652d/export Wed, 19 Aug 2026 19:44:41 +0000 https://vulnerability.circl.lu/sighting/ee37b479-5aed-4372-aa45-104d6389b1c3/export {"uuid": "ee37b479-5aed-4372-aa45-104d6389b1c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/secdb.bsky.social/post/3mthg3qes4x2p", "content": "\ud83d\udea8 CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0819)\n\n\u26a0\ufe0f CVE-2026-64849 - MLflow Server-Side Request Forgery Vulnerability\n\n\n#ZEN #SecDB #InfoSec #CISA_KEV", "creation_timestamp": "2026-08-19T19:00:14.420853Z"} {"uuid": "ee37b479-5aed-4372-aa45-104d6389b1c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/secdb.bsky.social/post/3mthg3qes4x2p", "content": "\ud83d\udea8 CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0819)\n\n\u26a0\ufe0f CVE-2026-64849 - MLflow Server-Side Request Forgery Vulnerability\n\n\n#ZEN #SecDB #InfoSec #CISA_KEV", "creation_timestamp": "2026-08-19T19:00:14.420853Z"} https://vulnerability.circl.lu/sighting/ee37b479-5aed-4372-aa45-104d6389b1c3/export Wed, 19 Aug 2026 19:00:14 +0000 https://vulnerability.circl.lu/sighting/61c179b0-f702-4c66-9de1-176c99c79cd1/export {"uuid": "61c179b0-f702-4c66-9de1-176c99c79cd1", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/9fc3fe97-7585-44d9-af56-6bae58615f6f", "content": "", "creation_timestamp": "2026-08-19T18:00:01.540208Z"} {"uuid": "61c179b0-f702-4c66-9de1-176c99c79cd1", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/9fc3fe97-7585-44d9-af56-6bae58615f6f", "content": "", "creation_timestamp": "2026-08-19T18:00:01.540208Z"} https://vulnerability.circl.lu/sighting/61c179b0-f702-4c66-9de1-176c99c79cd1/export Wed, 19 Aug 2026 18:00:01 +0000 https://vulnerability.circl.lu/sighting/b9328d6c-75c1-405a-8625-f04fe3991b51/export {"uuid": "b9328d6c-75c1-405a-8625-f04fe3991b51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mthc5vwzr72p", "content": "\ud83d\uded1 CVE-2026-64849\nMLflow MLflow\nCVSS 9.3 / EPSS 1% / KEV \u2705\nTL;DR: MLflow is an open source AI engineering platform for agents, large language models, and machine\u2026\nhttps://cvesentinel.com/report/CVE-2026-64849?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-08-19T17:49:52.553129Z"} {"uuid": "b9328d6c-75c1-405a-8625-f04fe3991b51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mthc5vwzr72p", "content": "\ud83d\uded1 CVE-2026-64849\nMLflow MLflow\nCVSS 9.3 / EPSS 1% / KEV \u2705\nTL;DR: MLflow is an open source AI engineering platform for agents, large language models, and machine\u2026\nhttps://cvesentinel.com/report/CVE-2026-64849?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-08-19T17:49:52.553129Z"} https://vulnerability.circl.lu/sighting/b9328d6c-75c1-405a-8625-f04fe3991b51/export Wed, 19 Aug 2026 17:49:52 +0000 https://vulnerability.circl.lu/sighting/7527cf66-3ca4-4e1b-9229-848fe926558e/export {"uuid": "7527cf66-3ca4-4e1b-9229-848fe926558e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-64849.yaml", "content": "", "creation_timestamp": "2026-08-19T00:00:03.269533Z"} {"uuid": "7527cf66-3ca4-4e1b-9229-848fe926558e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-64849.yaml", "content": "", "creation_timestamp": "2026-08-19T00:00:03.269533Z"} https://vulnerability.circl.lu/sighting/7527cf66-3ca4-4e1b-9229-848fe926558e/export Wed, 19 Aug 2026 00:00:03 +0000 https://vulnerability.circl.lu/sighting/263917b5-ef45-4d09-bbe3-3204e204e813/export {"uuid": "263917b5-ef45-4d09-bbe3-3204e204e813", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mtfeorh3bu2r", "content": "\ud83d\udea8 CRITICAL & ACTIVELY EXPLOITED: A severe SSRF flaw (CVE-2026-64849) in the MLflow AI platform allows attackers to steal cloud credentials. Upgrade to version 3.15.0 immediately and ensure your servers are not public-facing. #MLflow #SSRF #CyberSecu...\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-08-18T23:29:46.405667Z"} {"uuid": "263917b5-ef45-4d09-bbe3-3204e204e813", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mtfeorh3bu2r", "content": "\ud83d\udea8 CRITICAL & ACTIVELY EXPLOITED: A severe SSRF flaw (CVE-2026-64849) in the MLflow AI platform allows attackers to steal cloud credentials. Upgrade to version 3.15.0 immediately and ensure your servers are not public-facing. #MLflow #SSRF #CyberSecu...\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-08-18T23:29:46.405667Z"} https://vulnerability.circl.lu/sighting/263917b5-ef45-4d09-bbe3-3204e204e813/export Tue, 18 Aug 2026 23:29:46 +0000 https://vulnerability.circl.lu/sighting/7f944814-a947-43f4-afc6-0033a327b3a8/export {"uuid": "7f944814-a947-43f4-afc6-0033a327b3a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mtf7vxl4xx2k", "content": "Two critical vulnerabilities in MLflow (CVE-2026-64849, CVSS 9.3) and FUXA (CVE-2026-25895, CVSS 9.5) are under active exploitation. Attackers are exploiting [\u2026]", "creation_timestamp": "2026-08-18T22:04:24.202016Z"} {"uuid": "7f944814-a947-43f4-afc6-0033a327b3a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mtf7vxl4xx2k", "content": "Two critical vulnerabilities in MLflow (CVE-2026-64849, CVSS 9.3) and FUXA (CVE-2026-25895, CVSS 9.5) are under active exploitation. Attackers are exploiting [\u2026]", "creation_timestamp": "2026-08-18T22:04:24.202016Z"} https://vulnerability.circl.lu/sighting/7f944814-a947-43f4-afc6-0033a327b3a8/export Tue, 18 Aug 2026 22:04:24 +0000 https://vulnerability.circl.lu/sighting/b2ab106b-4ca7-4a6d-8eb5-2df087fca179/export {"uuid": "b2ab106b-4ca7-4a6d-8eb5-2df087fca179", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/serena666.bsky.social/post/3mtf4kbvv5w2m", "content": "MLflow SSRF (CVE-2026-64849) exploit for cloud creds in hours, bypassing prior fixes. You gotta hand it to 'em, the attackers don't waste time. Relentless", "creation_timestamp": "2026-08-18T21:04:07.220630Z"} {"uuid": "b2ab106b-4ca7-4a6d-8eb5-2df087fca179", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/serena666.bsky.social/post/3mtf4kbvv5w2m", "content": "MLflow SSRF (CVE-2026-64849) exploit for cloud creds in hours, bypassing prior fixes. You gotta hand it to 'em, the attackers don't waste time. Relentless", "creation_timestamp": "2026-08-18T21:04:07.220630Z"} https://vulnerability.circl.lu/sighting/b2ab106b-4ca7-4a6d-8eb5-2df087fca179/export Tue, 18 Aug 2026 21:04:07 +0000 https://vulnerability.circl.lu/sighting/806e7724-54e4-465f-9fd7-b2c31783b86a/export {"uuid": "806e7724-54e4-465f-9fd7-b2c31783b86a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mtf2kobzid25", "content": "\ud83e\udd16 CVE-2026-64849 (CVSS 9.3): unauthenticated SSRF in MLflow (<3.15.0) exploited in the wild to exfiltrate cloud credentials. CVE-2026-25895 (CVSS 9.5): path traversal to RCE in FUXA SCADA/HMI, mass scanning.\nhttps://thehackernews.com/2026/08/attackers-exploit-mlflow-ssrf-flaw-to.html", "creation_timestamp": "2026-08-18T20:28:31.184194Z"} {"uuid": "806e7724-54e4-465f-9fd7-b2c31783b86a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mtf2kobzid25", "content": "\ud83e\udd16 CVE-2026-64849 (CVSS 9.3): unauthenticated SSRF in MLflow (<3.15.0) exploited in the wild to exfiltrate cloud credentials. CVE-2026-25895 (CVSS 9.5): path traversal to RCE in FUXA SCADA/HMI, mass scanning.\nhttps://thehackernews.com/2026/08/attackers-exploit-mlflow-ssrf-flaw-to.html", "creation_timestamp": "2026-08-18T20:28:31.184194Z"} https://vulnerability.circl.lu/sighting/806e7724-54e4-465f-9fd7-b2c31783b86a/export Tue, 18 Aug 2026 20:28:31 +0000 https://vulnerability.circl.lu/sighting/164232a2-5645-4bbc-b241-d5f074d31089/export {"uuid": "164232a2-5645-4bbc-b241-d5f074d31089", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-64849", "type": "seen", "source": "https://bsky.app/profile/etairos-ai.bsky.social/post/3mtezagljq22f", "content": "MLflow SSRF (CVE-2026-64849): exploited for cloud metadata credential theft hours after disclosure. Patch ML infra like production. #ThreatIntel #AIsecurity #CriticalInfrastructure https://threat-intelligence.redeyesecurity.com/blog/mlflow-ssrf-cve-2026-64849-cloud-credential-theft-2026", "creation_timestamp": "2026-08-18T20:04:54.484618Z"} {"uuid": "164232a2-5645-4bbc-b241-d5f074d31089", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-64849", "type": "seen", "source": "https://bsky.app/profile/etairos-ai.bsky.social/post/3mtezagljq22f", "content": "MLflow SSRF (CVE-2026-64849): exploited for cloud metadata credential theft hours after disclosure. Patch ML infra like production. #ThreatIntel #AIsecurity #CriticalInfrastructure https://threat-intelligence.redeyesecurity.com/blog/mlflow-ssrf-cve-2026-64849-cloud-credential-theft-2026", "creation_timestamp": "2026-08-18T20:04:54.484618Z"} https://vulnerability.circl.lu/sighting/164232a2-5645-4bbc-b241-d5f074d31089/export Tue, 18 Aug 2026 20:04:54 +0000