CVE-2026-64849 CISA KEV · Actively exploitedSuited to automated attack · CISA
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
CVSS score
9.3
EPSS probability
%9.8
Risk score
1.8
Published
1 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
GitHub
este laboratorio puede estar bien o mal preguntale a la IA estoy probando pero debe funcionar hahahah
Makefile Go / Python
Nuclei: MLflow Webhook SSRF - Unauthenticated Full-Read via Redirect Bypass
Makefile Go / Python
Similar Vulnerabilities
9.8
CVE-2026-42208 Actively exploited
SQL injection in Litellm
L
Patch verified Public Exploits:1EPSS %6
9.6
CVE-2026-57496
NetLicensing MCP Server: REST Path Traversal Bypasses Token Redaction
L
Patch status unknown
6.5
CVE-2026-48710 Actively exploited
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
K
Patch verified Public Exploits:2EPSS %7
8.8
CVE-2026-59177
ESPHome Device Builder Dashboard: Unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces
P
Patch verified Public Exploits:1
8.6
CVE-2026-12075
Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode
P
Patch verified
8.3
CVE-2024-7039
CVE-2024-7039
P
Patch status unknown
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-64849"