kadet-hub
Image security report: mlflow recipe
mlflow: grade D, 203 findings, one per advisory and package, in the 1 image of version 1.0.0: CRITICAL 0, HIGH 56, MEDIUM 82, LOW 65, UNKNOWN 0. Scanned 2026-11-07 11:47 UTC.
Trivy 0.76.1 scanned the images with the vulnerability database of 2026-11-07. A finding is one advisory in one package of one image, so an advisory in two packages counts twice. The grade is Artifact Hub's: F with a CRITICAL finding, D with HIGH, C with MEDIUM, B with LOW, - with UNKNOWN findings only, A without findings. It rates known vulnerabilities in third-party images, not the recipe itself.
ghcr.io/mlflow/mlflow:v3.18.0-full@sha256:a8459ca08b1e8a0dc287b4e226d4f2338f56052d7e2d333a4aa5891be0670919
CRITICAL 0, HIGH 56, MEDIUM 82, LOW 65, UNKNOWN 0
| ID | Severity | Package | Version | Fixed in |
|---|---|---|---|---|
| CVE-2025-69720 | HIGH | libncursesw6 | 6.5+20250216-2 | |
| CVE-2025-69720 | HIGH | libtinfo6 | 6.5+20250216-2 | |
| CVE-2025-69720 | HIGH | ncurses-base | 6.5+20250216-2 | |
| CVE-2025-69720 | HIGH | ncurses-bin | 6.5+20250216-2 | |
| CVE-2026-109518 | HIGH | apt | 3.0.3 | 3.0.4 |
| CVE-2026-109518 | HIGH | libapt-pkg7.0 | 3.0.3 | 3.0.4 |
| CVE-2026-119373 | HIGH | libsqlite3-0 | 3.46.1-7+deb13u2 | |
| CVE-2026-119374 | HIGH | libsqlite3-0 | 3.46.1-7+deb13u2 | |
| CVE-2026-119379 | HIGH | libsqlite3-0 | 3.46.1-7+deb13u2 | |
| CVE-2026-16742 | HIGH | libsystemd0 | 257.13-1~deb13u1 | |
| CVE-2026-16742 | HIGH | libudev1 | 257.13-1~deb13u1 | |
| CVE-2026-23949 | HIGH | jaraco.context | 5.3.0 | 6.1.0 |
| CVE-2026-24049 | HIGH | wheel | 0.45.1 | 0.46.2 |
| CVE-2026-54369 | HIGH | libacl1 | 2.3.2-2+b1 | |
| CVE-2026-69247 | HIGH | cryptography | 46.0.7 | 50.0.0 |
| CVE-2026-69249 | HIGH | cryptography | 46.0.7 | 49.0.0 |
| CVE-2026-76642 | HIGH | bsdutils | 1:2.41.5-0+deb13u1 | |
| CVE-2026-76642 | HIGH | libblkid1 | 2.41.5-0+deb13u1 | |
| CVE-2026-76642 | HIGH | liblastlog2-2 | 2.41.5-0+deb13u1 | |
| CVE-2026-76642 | HIGH | libmount1 | 2.41.5-0+deb13u1 | |
| CVE-2026-76642 | HIGH | libsmartcols1 | 2.41.5-0+deb13u1 | |
| CVE-2026-76642 | HIGH | libuuid1 | 2.41.5-0+deb13u1 | |
| CVE-2026-76642 | HIGH | login | 1:4.16.0-2+really2.41.5-0+deb13u1 | |
| CVE-2026-76642 | HIGH | mount | 2.41.5-0+deb13u1 | |
| CVE-2026-76642 | HIGH | util-linux | 2.41.5-0+deb13u1 | |
| CVE-2026-76844 | HIGH | zlib1g | 1:1.3.dfsg+really1.3.1-1+b1 | |
| CVE-2026-78408 | HIGH | bsdutils | 1:2.41.5-0+deb13u1 | |
| CVE-2026-78408 | HIGH | libblkid1 | 2.41.5-0+deb13u1 | |
| CVE-2026-78408 | HIGH | liblastlog2-2 | 2.41.5-0+deb13u1 | |
| CVE-2026-78408 | HIGH | libmount1 | 2.41.5-0+deb13u1 | |
| CVE-2026-78408 | HIGH | libsmartcols1 | 2.41.5-0+deb13u1 | |
| CVE-2026-78408 | HIGH | libuuid1 | 2.41.5-0+deb13u1 | |
| CVE-2026-78408 | HIGH | login | 1:4.16.0-2+really2.41.5-0+deb13u1 | |
| CVE-2026-78408 | HIGH | mount | 2.41.5-0+deb13u1 | |
| CVE-2026-78408 | HIGH | util-linux | 2.41.5-0+deb13u1 | |
| CVE-2026-78409 | HIGH | bsdutils | 1:2.41.5-0+deb13u1 | |
| CVE-2026-78409 | HIGH | libblkid1 | 2.41.5-0+deb13u1 | |
| CVE-2026-78409 | HIGH | liblastlog2-2 | 2.41.5-0+deb13u1 | |
| CVE-2026-78409 | HIGH | libmount1 | 2.41.5-0+deb13u1 | |
| CVE-2026-78409 | HIGH | libsmartcols1 | 2.41.5-0+deb13u1 | |
| CVE-2026-78409 | HIGH | libuuid1 | 2.41.5-0+deb13u1 | |
| CVE-2026-78409 | HIGH | login | 1:4.16.0-2+really2.41.5-0+deb13u1 | |
| CVE-2026-78409 | HIGH | mount | 2.41.5-0+deb13u1 | |
| CVE-2026-78409 | HIGH | util-linux | 2.41.5-0+deb13u1 | |
| CVE-2026-78410 | HIGH | bsdutils | 1:2.41.5-0+deb13u1 | |
| CVE-2026-78410 | HIGH | libblkid1 | 2.41.5-0+deb13u1 | |
| CVE-2026-78410 | HIGH | liblastlog2-2 | 2.41.5-0+deb13u1 | |
| CVE-2026-78410 | HIGH | libmount1 | 2.41.5-0+deb13u1 | |
| CVE-2026-78410 | HIGH | libsmartcols1 | 2.41.5-0+deb13u1 | |
| CVE-2026-78410 | HIGH | libuuid1 | 2.41.5-0+deb13u1 | |
| CVE-2026-78410 | HIGH | login | 1:4.16.0-2+really2.41.5-0+deb13u1 | |
| CVE-2026-78410 | HIGH | mount | 2.41.5-0+deb13u1 | |
| CVE-2026-78410 | HIGH | util-linux | 2.41.5-0+deb13u1 | |
| CVE-2026-85091 | HIGH | zlib1g | 1:1.3.dfsg+really1.3.1-1+b1 | |
| CVE-2026-9538 | HIGH | perl-base | 5.40.1-6+deb13u1 | |
| GHSA-537c-gmf6-5ccf | HIGH | cryptography | 46.0.7 | 48.0.1 |
| CVE-2025-8869 | MEDIUM | pip | 24.0 | 25.3 |
| CVE-2026-102010 | MEDIUM | gcc-14-base | 14.2.0-19 | |
| CVE-2026-102010 | MEDIUM | libgcc-s1 | 14.2.0-19 | |
| CVE-2026-102010 | MEDIUM | libstdc++6 | 14.2.0-19 | |
| CVE-2026-114690 | MEDIUM | gcc-14-base | 14.2.0-19 | |
| CVE-2026-114690 | MEDIUM | libgcc-s1 | 14.2.0-19 | |
| CVE-2026-114690 | MEDIUM | libstdc++6 | 14.2.0-19 | |
| CVE-2026-114691 | MEDIUM | gcc-14-base | 14.2.0-19 | |
| CVE-2026-114691 | MEDIUM | libgcc-s1 | 14.2.0-19 | |
| CVE-2026-114691 | MEDIUM | libstdc++6 | 14.2.0-19 | |
| CVE-2026-115455 | MEDIUM | gcc-14-base | 14.2.0-19 | |
| CVE-2026-115455 | MEDIUM | libgcc-s1 | 14.2.0-19 | |
| CVE-2026-115455 | MEDIUM | libstdc++6 | 14.2.0-19 | |
| CVE-2026-119371 | MEDIUM | libsqlite3-0 | 3.46.1-7+deb13u2 | |
| CVE-2026-119372 | MEDIUM | libsqlite3-0 | 3.46.1-7+deb13u2 | |
| CVE-2026-119375 | MEDIUM | libsqlite3-0 | 3.46.1-7+deb13u2 | |
| CVE-2026-119376 | MEDIUM | libsqlite3-0 | 3.46.1-7+deb13u2 | |
| CVE-2026-119378 | MEDIUM | libsqlite3-0 | 3.46.1-7+deb13u2 | |
| CVE-2026-119591 | MEDIUM | libsqlite3-0 | 3.46.1-7+deb13u2 | |
| CVE-2026-13346 | MEDIUM | pip | 24.0 | 26.2.0 |
| CVE-2026-15059 | MEDIUM | libsystemd0 | 257.13-1~deb13u1 | |
| CVE-2026-15059 | MEDIUM | libudev1 | 257.13-1~deb13u1 | |
| CVE-2026-15534 | MEDIUM | perl-base | 5.40.1-6+deb13u1 | |
| CVE-2026-18374 | MEDIUM | libc-bin | 2.41-12+deb13u4 | |
| CVE-2026-18374 | MEDIUM | libc6 | 2.41-12+deb13u4 | |
| CVE-2026-18477 | MEDIUM | tar | 1.35+dfsg-3.1 | |
| CVE-2026-18508 | MEDIUM | tar | 1.35+dfsg-3.1 | |
| CVE-2026-19499 | MEDIUM | libc-bin | 2.41-12+deb13u4 | |
| CVE-2026-19499 | MEDIUM | libc6 | 2.41-12+deb13u4 | |
| CVE-2026-19542 | MEDIUM | libc-bin | 2.41-12+deb13u4 | |
| CVE-2026-19542 | MEDIUM | libc6 | 2.41-12+deb13u4 | |
| CVE-2026-27171 | MEDIUM | zlib1g | 1:1.3.dfsg+really1.3.1-1+b1 | |
| CVE-2026-3184 | MEDIUM | bsdutils | 1:2.41.5-0+deb13u1 | |
| CVE-2026-3184 | MEDIUM | libblkid1 | 2.41.5-0+deb13u1 | |
| CVE-2026-3184 | MEDIUM | liblastlog2-2 | 2.41.5-0+deb13u1 | |
| CVE-2026-3184 | MEDIUM | libmount1 | 2.41.5-0+deb13u1 | |
| CVE-2026-3184 | MEDIUM | libsmartcols1 | 2.41.5-0+deb13u1 | |
| CVE-2026-3184 | MEDIUM | libuuid1 | 2.41.5-0+deb13u1 | |
| CVE-2026-3184 | MEDIUM | login | 1:4.16.0-2+really2.41.5-0+deb13u1 | |
| CVE-2026-3184 | MEDIUM | mount | 2.41.5-0+deb13u1 | |
| CVE-2026-3184 | MEDIUM | util-linux | 2.41.5-0+deb13u1 | |
| CVE-2026-3219 | MEDIUM | pip | 24.0 | 26.1 |
| CVE-2026-42250 | MEDIUM | libbz2-1.0 | 1.0.8-6 | |
| CVE-2026-50812 | MEDIUM | libsqlite3-0 | 3.46.1-7+deb13u2 | |
| CVE-2026-50813 | MEDIUM | libsqlite3-0 | 3.46.1-7+deb13u2 | |
| CVE-2026-5435 | MEDIUM | libc-bin | 2.41-12+deb13u4 | |
| CVE-2026-5435 | MEDIUM | libc6 | 2.41-12+deb13u4 | |
| CVE-2026-54370 | MEDIUM | libacl1 | 2.3.2-2+b1 | |
| CVE-2026-54371 | MEDIUM | libattr1 | 1:2.5.2-3 | |
| CVE-2026-54411 | MEDIUM | libpam-modules | 1.7.0-5 | |
| CVE-2026-54411 | MEDIUM | libpam-modules-bin | 1.7.0-5 | |
| CVE-2026-54411 | MEDIUM | libpam-runtime | 1.7.0-5 | |
| CVE-2026-54411 | MEDIUM | libpam0g | 1.7.0-5 | |
| CVE-2026-5704 | MEDIUM | tar | 1.35+dfsg-3.1 | |
| CVE-2026-59890 | MEDIUM | setuptools | 79.0.1 | 83.0.0 |
| CVE-2026-6238 | MEDIUM | libc-bin | 2.41-12+deb13u4 | |
| CVE-2026-6238 | MEDIUM | libc6 | 2.41-12+deb13u4 | |
| CVE-2026-6357 | MEDIUM | pip | 24.0 | 26.1 |
| CVE-2026-6368 | MEDIUM | libc-bin | 2.41-12+deb13u4 | |
| CVE-2026-6368 | MEDIUM | libc6 | 2.41-12+deb13u4 | |
| CVE-2026-6791 | MEDIUM | libc-bin | 2.41-12+deb13u4 | |
| CVE-2026-6791 | MEDIUM | libc6 | 2.41-12+deb13u4 | |
| CVE-2026-69248 | MEDIUM | cryptography | 46.0.7 | 49.0.0 |
| CVE-2026-77117 | MEDIUM | libc-bin | 2.41-12+deb13u4 | |
| CVE-2026-77117 | MEDIUM | libc6 | 2.41-12+deb13u4 | |
| CVE-2026-80489 | MEDIUM | libc-bin | 2.41-12+deb13u4 | |
| CVE-2026-80489 | MEDIUM | libc6 | 2.41-12+deb13u4 | |
| CVE-2026-82560 | MEDIUM | perl-base | 5.40.1-6+deb13u1 | |
| CVE-2026-84243 | MEDIUM | libc-bin | 2.41-12+deb13u4 | |
| CVE-2026-84243 | MEDIUM | libc6 | 2.41-12+deb13u4 | |
| CVE-2026-8643 | MEDIUM | pip | 24.0 | 26.1.2 |
| CVE-2026-8674 | MEDIUM | libc-bin | 2.41-12+deb13u4 | |
| CVE-2026-8674 | MEDIUM | libc6 | 2.41-12+deb13u4 | |
| CVE-2026-86805 | MEDIUM | libc-bin | 2.41-12+deb13u4 | |
| CVE-2026-86805 | MEDIUM | libc6 | 2.41-12+deb13u4 | |
| CVE-2026-89092 | MEDIUM | libc-bin | 2.41-12+deb13u4 | |
| CVE-2026-89092 | MEDIUM | libc6 | 2.41-12+deb13u4 | |
| CVE-2026-95619 | MEDIUM | gcc-14-base | 14.2.0-19 | |
| CVE-2026-95619 | MEDIUM | libgcc-s1 | 14.2.0-19 | |
| CVE-2026-95619 | MEDIUM | libstdc++6 | 14.2.0-19 | |
| CVE-2026-95818 | MEDIUM | libc-bin | 2.41-12+deb13u4 | |
| CVE-2026-95818 | MEDIUM | libc6 | 2.41-12+deb13u4 | |
| CVE-2005-2541 | LOW | tar | 1.35+dfsg-3.1 | |
| CVE-2007-5686 | LOW | login.defs | 1:4.17.4-2 | |
| CVE-2007-5686 | LOW | passwd | 1:4.17.4-2 | |
| CVE-2010-4756 | LOW | libc-bin | 2.41-12+deb13u4 | |
| CVE-2010-4756 | LOW | libc6 | 2.41-12+deb13u4 | |
| CVE-2011-3374 | LOW | apt | 3.0.3 | |
| CVE-2011-3374 | LOW | libapt-pkg7.0 | 3.0.3 | |
| CVE-2011-4116 | LOW | perl-base | 5.40.1-6+deb13u1 | |
| CVE-2013-4392 | LOW | libsystemd0 | 257.13-1~deb13u1 | |
| CVE-2013-4392 | LOW | libudev1 | 257.13-1~deb13u1 | |
| CVE-2017-18018 | LOW | coreutils | 9.7-3 | |
| CVE-2018-20796 | LOW | libc-bin | 2.41-12+deb13u4 | |
| CVE-2018-20796 | LOW | libc6 | 2.41-12+deb13u4 | |
| CVE-2019-1010022 | LOW | libc-bin | 2.41-12+deb13u4 | |
| CVE-2019-1010022 | LOW | libc6 | 2.41-12+deb13u4 | |
| CVE-2019-1010023 | LOW | libc-bin | 2.41-12+deb13u4 | |
| CVE-2019-1010023 | LOW | libc6 | 2.41-12+deb13u4 | |
| CVE-2019-1010024 | LOW | libc-bin | 2.41-12+deb13u4 | |
| CVE-2019-1010024 | LOW | libc6 | 2.41-12+deb13u4 | |
| CVE-2019-1010025 | LOW | libc-bin | 2.41-12+deb13u4 | |
| CVE-2019-1010025 | LOW | libc6 | 2.41-12+deb13u4 | |
| CVE-2019-9192 | LOW | libc-bin | 2.41-12+deb13u4 | |
| CVE-2019-9192 | LOW | libc6 | 2.41-12+deb13u4 | |
| CVE-2021-45346 | LOW | libsqlite3-0 | 3.46.1-7+deb13u2 | |
| CVE-2022-0563 | LOW | bsdutils | 1:2.41.5-0+deb13u1 | |
| CVE-2022-0563 | LOW | libblkid1 | 2.41.5-0+deb13u1 | |
| CVE-2022-0563 | LOW | liblastlog2-2 | 2.41.5-0+deb13u1 | |
| CVE-2022-0563 | LOW | libmount1 | 2.41.5-0+deb13u1 | |
| CVE-2022-0563 | LOW | libsmartcols1 | 2.41.5-0+deb13u1 | |
| CVE-2022-0563 | LOW | libuuid1 | 2.41.5-0+deb13u1 | |
| CVE-2022-0563 | LOW | login | 1:4.16.0-2+really2.41.5-0+deb13u1 | |
| CVE-2022-0563 | LOW | mount | 2.41.5-0+deb13u1 | |
| CVE-2022-0563 | LOW | util-linux | 2.41.5-0+deb13u1 | |
| CVE-2023-31437 | LOW | libsystemd0 | 257.13-1~deb13u1 | |
| CVE-2023-31437 | LOW | libudev1 | 257.13-1~deb13u1 | |
| CVE-2023-31438 | LOW | libsystemd0 | 257.13-1~deb13u1 | |
| CVE-2023-31438 | LOW | libudev1 | 257.13-1~deb13u1 | |
| CVE-2023-31439 | LOW | libsystemd0 | 257.13-1~deb13u1 | |
| CVE-2023-31439 | LOW | libudev1 | 257.13-1~deb13u1 | |
| CVE-2024-56433 | LOW | login.defs | 1:4.17.4-2 | |
| CVE-2024-56433 | LOW | passwd | 1:4.17.4-2 | |
| CVE-2025-5278 | LOW | coreutils | 9.7-3 | |
| CVE-2025-6141 | LOW | libncursesw6 | 6.5+20250216-2 | |
| CVE-2025-6141 | LOW | libtinfo6 | 6.5+20250216-2 | |
| CVE-2025-6141 | LOW | ncurses-base | 6.5+20250216-2 | |
| CVE-2025-6141 | LOW | ncurses-bin | 6.5+20250216-2 | |
| CVE-2025-70873 | LOW | libsqlite3-0 | 3.46.1-7+deb13u2 | |
| CVE-2026-102473 | LOW | dash | 0.5.12-12 | |
| CVE-2026-102474 | LOW | dash | 0.5.12-12 | |
| CVE-2026-119377 | LOW | libsqlite3-0 | 3.46.1-7+deb13u2 | |
| CVE-2026-1703 | LOW | pip | 24.0 | 26.0 |
| CVE-2026-40228 | LOW | libsystemd0 | 257.13-1~deb13u1 | |
| CVE-2026-40228 | LOW | libudev1 | 257.13-1~deb13u1 | |
| CVE-2026-44405 | LOW | paramiko | 3.5.1 | 5.0.0 |
| CVE-2026-53910 | LOW | diffutils | 1:3.10-4 | |
| CVE-2026-56391 | LOW | coreutils | 9.7-3 | |
| CVE-2026-56392 | LOW | coreutils | 9.7-3 | |
| CVE-2026-97399 | LOW | libc-bin | 2.41-12+deb13u4 | |
| CVE-2026-97399 | LOW | libc6 | 2.41-12+deb13u4 | |
| GHSA-xmj3-9gf7-h52w | LOW | setuptools | 79.0.1 | 84.1.0 |
| TEMP-0290435-0B57B5 | LOW | tar | 1.35+dfsg-3.1 | |
| TEMP-0517018-A83CE6 | LOW | sysvinit-utils | 3.14-4 | |
| TEMP-0628843-DBAD28 | LOW | login.defs | 1:4.17.4-2 | |
| TEMP-0628843-DBAD28 | LOW | passwd | 1:4.17.4-2 | |
| TEMP-0841856-B18BAF | LOW | bash | 5.2.37-2+b10 |