https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-8406.htmlhttps://patchthecve.com/cve/CVE-2025-8406.htmlMon, 19 Oct 2026 16:10:00 +0000HIGH 7.8: ZenML version 0.83.1 is affected by a path traversal vulnerability in the `PathMaterializer` class. The `load` function uses `is_path_within_directory` to validate files during `data.tar.gz` extraction, which fails to effectively detect symbolic and hard links. This vulnerability can lead to arbitrahttps://patchthecve.com/cve/CVE-2024-9340.htmlhttps://patchthecve.com/cve/CVE-2024-9340.htmlWed, 17 Jun 2026 08:24:22 +0000HIGH 7.5: A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart requests with arbitrary characters appended to the end of multipart boundaries. This flaw in the multipart request boundaryhttps://patchthecve.com/cve/CVE-2024-4311.htmlhttps://patchthecve.com/cve/CVE-2024-4311.htmlWed, 17 Jun 2026 08:01:38 +0000MEDIUM 5.4: zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password change function. An attacker can brute-force the current password in the 'Update Password' function, allowing them to take over the user's account. This vulnerability is due to the abshttps://patchthecve.com/cve/CVE-2024-5062.htmlhttps://patchthecve.com/cve/CVE-2024-5062.htmlWed, 17 Jun 2026 08:15:00 +0000MEDIUM 6.1: A reflected Cross-Site Scripting (XSS) vulnerability was identified in zenml-io/zenml version 0.57.1. The vulnerability exists due to improper neutralization of input during web page generation, specifically within the survey redirect parameter. This flaw allows an attacker to redirect users to a sphttps://patchthecve.com/cve/CVE-2024-4680.htmlhttps://patchthecve.com/cve/CVE-2024-4680.htmlWed, 17 Jun 2026 08:02:24 +0000HIGH 8.8: A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change, enabling an attacker to maintain access to a compromised account without the vihttps://patchthecve.com/cve/CVE-2024-2383.htmlhttps://patchthecve.com/cve/CVE-2024-2383.htmlWed, 17 Jun 2026 07:24:25 +0000MEDIUM 6.1: A clickjacking vulnerability exists in zenml-io/zenml versions up to and including 0.55.5 due to the application's failure to set appropriate X-Frame-Options or Content-Security-Policy HTTP headers. This vulnerability allows an attacker to embed the application UI within an iframe on a malicious paghttps://patchthecve.com/cve/CVE-2024-2213.htmlhttps://patchthecve.com/cve/CVE-2024-2213.htmlWed, 17 Jun 2026 07:23:56 +0000LOW 3.3: An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. This vulnerability allows for unauthorized accounthttps://patchthecve.com/cve/CVE-2024-2171.htmlhttps://patchthecve.com/cve/CVE-2024-2171.htmlWed, 17 Jun 2026 07:23:51 +0000MEDIUM 4.8: A stored Cross-Site Scripting (XSS) vulnerability was identified in the zenml-io/zenml repository, specifically within the 'logo_url' field. By injecting malicious payloads into this field, an attacker could send harmful messages to other users, potentially compromising their accounts. The vulnerabihttps://patchthecve.com/cve/CVE-2024-2035.htmlhttps://patchthecve.com/cve/CVE-2024-2035.htmlWed, 17 Jun 2026 07:23:36 +0000MEDIUM 6.5: An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint. This vulnerability allows any authenticated user to modify the information of other users, including changing the `active` status of user accounts to false, effhttps://patchthecve.com/cve/CVE-2024-2032.htmlhttps://patchthecve.com/cve/CVE-2024-2032.htmlWed, 17 Jun 2026 07:23:35 +0000LOW 3.1: A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests are sent in parallel. This issue was fixed in version 0.55.5. The vulnerability arises due to insufficient handling of con