bentoml

Products

Exploited and recent CVEs

• CVE-2026-112264 High 7.8 BentoML through 1.4.39 Dockerfile Instruction Injection via docker.env Keys 0.2%
• CVE-2026-78205 Medium 5.8 BentoML 1.4.19 through 1.4.39 Server-Side Request Forgery via Unfiltered RFC 6598 Shared Address Space 0.4%
• CVE-2026-15035 Medium 5.3 bentoml OpenLLM Model Repository Directory Name common.py async_run_command command injection 2.2%
• CVE-2026-44345 High 8.8 BentoML: Dockerfile command injection via docker.base_image 0.3%
• CVE-2026-44346 High 8.8 BentoML: Dockerfile command injection via envs[*].name in bentofile.yaml 0.3%
• CVE-2026-40610 Medium 5.5 BentoML has Information Disclosure in `bentoml build` via symlink traversal in the build context 0.3%
• CVE-2026-35044 High 8.8 BentoML has a Server-Side Template Injection via unsandboxed Jinja2 Environment in Dockerfile generation 0.4%
• CVE-2026-35043 High 7.8 BentoML: command injection in cloud deployment setup script (deployment.py) 0.3%
• CVE-2026-33744 High 7.8 BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml 0.3%
• CVE-2026-27905 High 8.6 BentoML has an Arbitrary File Write via Symlink Path Traversal in Tar Extraction 0.3%
• CVE-2026-24123 High 7.4 BentoML has a Path Traversal via Bentofile Configuration 0.5%
• CVE-2025-54381 Critical 9.9 BentoML is Vulnerable to an SSRF Attack Through File Upload Processing 13.2%
• CVE-2025-32375 Critical 9.8 Insecure Deserialization leads to RCE in BentoML's runner server 52.4%
• CVE-2025-27520 Critical 9.8 BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization 40.6%
• CVE-2024-8982 Medium 6.2 Local File Inclusion in bentoml/openllm 0.8%
• CVE-2024-9070 Critical 9.8 Deserialization Vulnerability in BentoML's Runner Server in bentoml/bentoml 0.9%
• CVE-2024-9056 High 7.5 Denial of Service in bentoml/bentoml 0.7%
• CVE-2024-2912 Critical 10.0 Insecure Deserialization Leading to RCE in bentoml/bentoml 1.5%