ZenML records

14 published records for vendor zenml.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 2
With a fix record: 85.7%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

14 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
56Plan	CVE-2024-25723Proof of concept	ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{uszenml · zenml · CWE-284 Broken access control (IDOR)	High8.8	—	70.8%	Feb 27, 2024
50Plan	CVE-2024-2083Proof of concept	Directory Traversal in zenml-io/zenmlzenml · zenml · CWE-29 Path traversal	Critical9.9	—	37.5%	Apr 15, 2024
35Monitor	CVE-2024-28424No exploit	zenml v0.55.4 was discovered to contain an arbitrary file upload vulnerability in the load function at /materializers/cloudpickle_materializzenml · zenml · CWE-94 pre-auth RCE File upload	High8.8	—	0.7%	Mar 14, 2024
35Monitor	CVE-2024-4680No exploit	Insufficient Session Expiration in zenml-io/zenmlzenml · zenml · CWE-613 Pre-auth	High8.8	—	0.4%	Jun 8, 2024
31Monitor	CVE-2025-8406No exploit	Path Traversal in zenml-io/zenmlzenml · zenml · CWE-22 RCE Path traversal	High7.8	—	0.4%	Oct 5, 2025
30Monitor	CVE-2024-9340No exploit	Denial of Service (DoS) via Multipart Boundary in zenml-io/zenmlzenml · zenml · CWE-835 Pre-auth Denial of service	High7.5	—	1.0%	Mar 20, 2025
26Monitor	CVE-2024-2035No exploit	Improper Authorization in zenml-io/zenmlzenml · zenml · CWE-862 Broken access control (IDOR)	Medium6.5	—	0.6%	Jun 6, 2024
24Monitor	CVE-2024-5062No exploit	Reflected XSS through survey redirect parameter in zenml-io/zenmlzenml · zenml · CWE-79 pre-auth RCE XSS	Medium6.1	—	0.4%	Jun 30, 2024
24Monitor	CVE-2024-2383No exploit	Clickjacking Vulnerability in zenml-io/zenmlzenml · zenml · CWE-1021 Pre-auth	Medium6.1	—	0.4%	Jun 6, 2024
21Monitor	CVE-2024-4311No exploit	Lack of login attempt rate-limiting in zenml-io/zenmlzenml · zenml · CWE-770 Denial of service	Medium5.4	—	0.5%	Nov 14, 2024
19Monitor	CVE-2024-2171No exploit	Stored XSS in zenml-io/zenmlzenml · zenml · CWE-79 XSS	Medium4.8	—	0.4%	Jun 6, 2024
16Monitor	CVE-2024-2260No exploit	Session Fixation Vulnerability in zenml-io/zenmlzenml · zenml · CWE-384 Pre-auth Auth bypass	Medium4.2	—	0.4%	Apr 15, 2024
13Monitor	CVE-2024-2213No exploit	Improper Authentication in zenml-io/zenmlzenml · zenml · CWE-620 Auth bypass	Low3.3	—	0.2%	Jun 6, 2024
12Monitor	CVE-2024-2032No exploit	Race Condition Vulnerability in zenml-io/zenmlzenml · zenml · CWE-366 Race condition	Low3.1	—	0.3%	Jun 6, 2024

CVE-2024-25723
56Plan
ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{us
HighCVSS 8.8Proof of conceptEPSS 71%
- Broken access control (IDOR)
zenml · zenmlFeb 27, 2024
CVE-2024-2083
50Plan
Directory Traversal in zenml-io/zenml
CriticalCVSS 9.9Proof of conceptEPSS 37%
- Path traversal
zenml · zenmlApr 15, 2024
CVE-2024-28424
35Monitor
zenml v0.55.4 was discovered to contain an arbitrary file upload vulnerability in the load function at /materializers/cloudpickle_materializ
HighCVSS 8.8No exploitEPSS 1%
- pre-auth RCE
- File upload
zenml · zenmlMar 14, 2024
CVE-2024-4680
35Monitor
Insufficient Session Expiration in zenml-io/zenml
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
zenml · zenmlJun 8, 2024
CVE-2025-8406
31Monitor
Path Traversal in zenml-io/zenml
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Path traversal
zenml · zenmlOct 5, 2025
CVE-2024-9340
30Monitor
Denial of Service (DoS) via Multipart Boundary in zenml-io/zenml
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Denial of service
zenml · zenmlMar 20, 2025
CVE-2024-2035
26Monitor
Improper Authorization in zenml-io/zenml
MediumCVSS 6.5No exploitEPSS 1%
- Broken access control (IDOR)
zenml · zenmlJun 6, 2024
CVE-2024-5062
24Monitor
Reflected XSS through survey redirect parameter in zenml-io/zenml
MediumCVSS 6.1No exploitEPSS 0%
- pre-auth RCE
- XSS
zenml · zenmlJun 30, 2024
CVE-2024-2383
24Monitor
Clickjacking Vulnerability in zenml-io/zenml
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
zenml · zenmlJun 6, 2024
CVE-2024-4311
21Monitor
Lack of login attempt rate-limiting in zenml-io/zenml
MediumCVSS 5.4No exploitEPSS 0%
- Denial of service
zenml · zenmlNov 14, 2024
CVE-2024-2171
19Monitor
Stored XSS in zenml-io/zenml
MediumCVSS 4.8No exploitEPSS 0%
- XSS
zenml · zenmlJun 6, 2024
CVE-2024-2260
16Monitor
Session Fixation Vulnerability in zenml-io/zenml
MediumCVSS 4.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
zenml · zenmlApr 15, 2024
CVE-2024-2213
13Monitor
Improper Authentication in zenml-io/zenml
LowCVSS 3.3No exploitEPSS 0%
- Auth bypass
zenml · zenmlJun 6, 2024
CVE-2024-2032
12Monitor
Race Condition Vulnerability in zenml-io/zenml
LowCVSS 3.1No exploitEPSS 0%
- Race condition
zenml · zenmlJun 6, 2024