Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
18 results
Oct 19, 2026BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlinesCVE-2026-112264 · Other software · bentoml · reported by VulnCheckHigh 8.5
BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento archive so that bentoml containerize executes injected RUN instructions during docker build, accessing build secrets and poisoning images.
- Product
- BentoML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2026BentoML's outbound connection safeguard (make_safe_connect in _internal/utils/uri.py) blocks private, loopback, and link-local IP addresses but fails to reject CVE-2026-78205 · Other software · bentoml · reported by VulnCheckMedium 6.9
BentoML's outbound connection safeguard (make_safe_connect in _internal/utils/uri.py) blocks private, loopback, and link-local IP addresses but fails to reject the RFC 6598 shared address space (100.64.0.0/10, CGNAT). In versions 1.4.19 through 1.4.39, an unauthenticated attacker can supply URLs pointing to that range via multipart file handling (MultipartSerde.ensure_file) or JSON request parsing (JSONSerde.parse_request), causing the server to make outbound requests to internal hosts on CGNAT networks (Server-Side Request Forgery). This is an incomplete fix for CVE-2025-54381.
- Product
- BentoML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026A vulnerability was found in bentoml OpenLLM 0.6.30.CVE-2026-15035 · Other software · bentoml · reported by VulDBLow 1.9
A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function async_run_command of the file src/openllm/common.py of the component Model Repository Directory Name Handler. Performing a manipulation of the argument cmd results in command injection. Attacking locally is a requirement. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- OpenLLM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026BentoML is a Python library for building online serving systems optimized for AI apps and model inference.CVE-2026-44346 · Other software · bentoml · reported by GitHubHigh 8.8
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, a malicious bentofile.yaml containing a newline-injected value in envs[*].name produces unquoted RUN directives in the BentoML-generated Dockerfile. When the victim runs bentoml containerize on the imported bento, those RUN directives execute on the host during docker build. This vulnerability is fixed in 1.4.39.
- Product
- BentoML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026BentoML is a Python library for building online serving systems optimized for AI apps and model inference.CVE-2026-44345 · Other software · bentoml · reported by GitHubHigh 8.8
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, src/bentoml/_internal/container/frontend/dockerfile/templates/base_v2.j2 interpolates docker.base_image raw with no escaping, newline filtering, or validation. A malicious bento.yaml with a multi-line docker.base_image value smuggles arbitrary Dockerfile directives into the generated Dockerfile, and bentoml containerize then runs docker build which executes the injected RUN directives on the victim host. This vulnerability is fixed in 1.4.39.
- Product
- BentoML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026BentoML is a Python library for building online serving systems optimized for AI apps and model inference.CVE-2026-40610 · Other software · bentoml · reported by GitHubMedium 5.5
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.38 and prior, the build packaging workflow follows attacker-controlled symlinks inside the build context and copies the referenced file contents into the generated Bento artifact. If a victim builds an untrusted repository or other attacker-supplied build context, the attacker can place a symlink such as loot.txt -> /tmp/outside-marker.txt or a link to a more sensitive local file. When bentoml build runs, BentoML dereferences the symlink and packages the target file contents into the Bento. The leaked file can then propagate further through export, push, or containerization workflows. An attacker can exfiltrate local files from the build host into the Bento artifact, exposing secrets such as cloud credentials, SSH keys, API tokens, environment files, or other sensitive local configurations. Because Bento artifacts are commonly exported, uploaded, stored, or containerized after build, the leaked file contents can spread beyond the original build machine. This issue has been fixed in version 1.4.39.
- Product
- BentoML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026BentoML is a Python library for building online serving systems optimized for AI apps and model inference.CVE-2026-35044 · Other software · bentoml · reported by GitHubHigh 8.8
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.38, the Dockerfile generation function generate_containerfile() in src/bentoml/_internal/container/generate.py uses an unsandboxed jinja2.Environment with the jinja2.ext.do extension to render user-provided dockerfile_template files. When a victim imports a malicious bento archive and runs bentoml containerize, attacker-controlled Jinja2 template code executes arbitrary Python directly on the host machine, bypassing all container isolation. This vulnerability is fixed in 1.4.38.
- Product
- BentoML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026BentoML is a Python library for building online serving systems optimized for AI apps and model inference.CVE-2026-35043 · Other software · bentoml · reported by GitHubHigh 7.8
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.38, the cloud deployment path in src/bentoml/_internal/cloud/deployment.py was not included in the fix for CVE-2026-33744. Line 1648 interpolates system_packages directly into a shell command using an f-string without any quoting. The generated script is uploaded to BentoCloud as setup.sh and executed on the cloud build infrastructure during deployment, making this a remote code execution on the CI/CD tier. This vulnerability is fixed in 1.4.38.
- Product
- BentoML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026BentoML is a Python library for building online serving systems optimized for AI apps and model inference.CVE-2026-33744 · Other software · bentoml · reported by GitHubHigh 7.8
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.37, the `docker.system_packages` field in `bentofile.yaml` accepts arbitrary strings that are interpolated directly into Dockerfile `RUN` commands without sanitization. Since `system_packages` is semantically a list of OS package names (data), users do not expect values to be interpreted as shell commands. A malicious `bentofile.yaml` achieves arbitrary command execution during `bentoml containerize` / `docker build`. Version 1.4.37 fixes the issue.
- Product
- BentoML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2026BentoML is a Python library for building online serving systems optimized for AI apps and model inference.CVE-2026-27905 · Other software · bentoml · reported by GitHubHigh 8.6
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.36, the safe_extract_tarfile() function validates that each tar member's path is within the destination directory, but for symlink members it only validates the symlink's own path, not the symlink's target. An attacker can create a malicious bento/model tar file containing a symlink pointing outside the extraction directory, followed by a regular file that writes through the symlink, achieving arbitrary file write on the host filesystem. This vulnerability is fixed in 1.4.36.
- Product
- BentoML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2026BentoML is a Python library for building online serving systems optimized for AI apps and model inference.CVE-2026-24123 · Other software · bentoml · reported by GitHubHigh 7.4
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML's `bentofile.yaml` configuration allows path traversal attacks through multiple file path fields (`description`, `docker.setup_script`, `docker.dockerfile_template`, `conda.environment_yml`). An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files from the filesystem into the bento archive. This enables supply chain attacks where sensitive files (SSH keys, credentials, environment variables) are silently embedded in bentos and exposed when pushed to registries or deployed. Version 1.4.34 contains a patch for the issue.
- Product
- BentoML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2025BentoML is a Python library for building online serving systems optimized for AI apps and model inference.CVE-2025-54381 · Other software · bentoml · reported by GitHubCritical 9.9
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.0 until 1.4.19, the file upload processing system contains an SSRF vulnerability that allows unauthenticated remote attackers to force the server to make arbitrary HTTP requests. The vulnerability stems from the multipart form data and JSON request handlers, which automatically download files from user-provided URLs without validating whether those URLs point to internal network addresses, cloud metadata endpoints, or other restricted resources. The documentation explicitly promotes this URL-based file upload feature, making it an intended design that exposes all deployed services to SSRF attacks by default. Version 1.4.19 contains a patch for the issue.
- Product
- BentoML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2025BentoML is a Python library for building online serving systems optimized for AI apps and model inference.CVE-2025-32375 · Other software · bentoml · reported by GitHubCritical 9.8
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.8, there was an insecure deserialization in BentoML's runner server. By setting specific headers and parameters in the POST request, it is possible to execute any unauthorized arbitrary code on the server, which will grant the attackers to have the initial access and information disclosure on the server. This vulnerability is fixed in 1.4.8.
- Product
- BentoML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025BentoML is a Python library for building online serving systems optimized for AI apps and model inference.CVE-2025-27520 · Other software · bentoml · reported by GitHubCritical 9.8
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution (RCE) vulnerability caused by insecure deserialization has been identified in the latest version (v1.4.2) of BentoML. It allows any unauthenticated user to execute arbitrary code on the server. It exists an unsafe code segment in serde.py. This vulnerability is fixed in 1.4.3.
- Product
- BentoML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions <=1.3.4.post1.CVE-2024-9070 · Other software · bentoml · reported by security@huntr.devCritical 9.8
A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions <=1.3.4.post1. By setting specific parameters, an attacker can execute unauthorized arbitrary code on the server, causing severe harm. The vulnerability is triggered when the args-number parameter is greater than 1, leading to automatic deserialization and arbitrary code execution.
- Product
- bentoml/bentoml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025BentoML version v1.3.4post1 is vulnerable to a Denial of Service (DoS) attack.CVE-2024-9056 · Other software · bentoml · reported by security@huntr.devHigh 7.5
BentoML version v1.3.4post1 is vulnerable to a Denial of Service (DoS) attack. The vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. This causes the server to continuously process each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction, impacting all users of the service.
- Product
- bentoml/bentoml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A Local File Inclusion (LFI) vulnerability in OpenLLM version 0.6.10 allows attackers to include files from the local server through the web application.CVE-2024-8982 · Other software · bentoml · reported by security@huntr.devMedium 6.2
A Local File Inclusion (LFI) vulnerability in OpenLLM version 0.6.10 allows attackers to include files from the local server through the web application. This flaw could expose internal server files and potentially sensitive information such as configuration files, passwords, and other critical data. Unauthorized access to critical server files, such as configuration files, user credentials (/etc/passwd), and private keys, can lead to a complete compromise of the system's security. Attackers could leverage the exposed information to further penetrate the network, exfiltrate data, or escalate privileges within the environment.
- Product
- bentoml/openllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024An insecure deserialization vulnerability exists in the BentoML framework, allowing remote code execution (RCE) by sending a specially crafted POST request.CVE-2024-2912 · Other software · bentoml · reported by security@huntr.devCritical 10
An insecure deserialization vulnerability exists in the BentoML framework, allowing remote code execution (RCE) by sending a specially crafted POST request. By exploiting this vulnerability, attackers can execute arbitrary commands on the server hosting the BentoML application. The vulnerability is triggered when a serialized object, crafted to execute OS commands upon deserialization, is sent to any valid BentoML endpoint. This issue poses a significant security risk, enabling attackers to compromise the server and potentially gain unauthorized access or control.
- Product
- bentoml/bentoml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.