Wednesday, August 19, 2026 · 1 of 5

1. Unauthenticated SSRF in MLflow (CVE-2026-64849, CVSS 9.3) is being exploited in the wild

   — attackers hit cloud metadata endpoints to steal credentials; fixed in 3.15.0 (Aug 17–18)

   SecurityInfra