CVE-2026-15035 | Medium | 5.3 | 2026-07-08 | A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function async_run_command of the file src/openllm/common.py of the component Model Repos… |
CVE-2026-44346 | High | 8.8 | 2026-05-27 | BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, a malicious bentofile.yaml containi… |
CVE-2026-44345 | High | 8.8 | 2026-05-27 | BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, src/bentoml/_internal/container/fro… |
CVE-2026-40610 | Medium | 5.5 | 2026-05-22 | BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.38 and prior, the build packaging wo… |
CVE-2026-35044 | High | 8.8 | 2026-04-06 | BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.38, the Dockerfile generation function… |
CVE-2026-35043 | High | 7.8 | 2026-04-06 | BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.38, the cloud deployment path in src/be… |
CVE-2026-33744 | High | 7.8 | 2026-03-27 | BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.37, the `docker.system_packages` field… |
CVE-2026-27905 | High | 7.8 | 2026-03-03 | BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.36, the safe_extract_tarfile() function… |
CVE-2026-24123 | High | 7.4 | 2026-01-26 | BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML's `bentofile.yaml`… |
CVE-2025-54381 | Critical | 9.9 | 2025-07-29 | BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.0 until 1.4.19, the file upload proc… |
CVE-2025-32375 | Critical | 9.8 | 2025-04-09 | BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.8, there was an insecure deserializatio… |
CVE-2025-27520 | Critical | 9.8 | 2025-04-04 | BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution (RCE) vulnerability caused b… |
CVE-2024-9070 | Critical | 9.8 | 2025-03-20 | A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions <=1.3.4.post1. By setting specific parameters, an attacker can ex… |
CVE-2024-9056 | High | 7.5 | 2025-03-20 | BentoML version v1.3.4post1 is vulnerable to a Denial of Service (DoS) attack. The vulnerability can be exploited by appending characters, such as dashes (-)… |
CVE-2024-8982 | Medium | 6.2 | 2025-03-20 | A Local File Inclusion (LFI) vulnerability in OpenLLM version 0.6.10 allows attackers to include files from the local server through the web application. This… |
CVE-2024-2912 | Critical | 10.0 | 2024-04-16 | An insecure deserialization vulnerability exists in the BentoML framework, allowing remote code execution (RCE) by sending a specially crafted POST request. By… |