# zenml (PyPI) vulnerabilities Source: https://junglewise.ai/threats/technologies/pypi-zenml Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/pypi-zenml.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 14 vulnerabilities in zenml (PyPI): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2025-8406, was published on 7 July 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 14 (0 critical, 0 exploited in the wild) ## About zenml (PyPI) Python framework for building production-ready machine learning pipelines. ## Latest zenml (PyPI) vulnerabilities - [CVE-2025-8406: PYSEC-2026-2071 - ZenML is vulnerable to Path Traversal through its `PathMaterializer` class](https://junglewise.ai/threats/cve-2025-8406-zenml-is-vulnerable-to-path-traversal-through-its-pathmaterializer) (low, CVSS 3, published 7 Jul 2026) - [CVE-2024-4311: PYSEC-2026-2070 - Missing ratelimit on passwrod resets in zenml](https://junglewise.ai/threats/cve-2024-4311-missing-ratelimit-on-passwrod-resets-in-zenml) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-4460: PYSEC-2026-2068 - Improper line feed handling in zenml](https://junglewise.ai/threats/cve-2024-4460-improper-line-feed-handling-in-zenml) (low, CVSS 3, published 7 Jul 2026) - [CVE-2024-4680: PYSEC-2026-2069 - zenml-io/zenml does not expire the session after password reset](https://junglewise.ai/threats/cve-2024-4680-zenml-io-zenml-does-not-expire-the-session-after-password-reset) (low, CVSS 3, published 7 Jul 2026) - [CVE-2024-25723: PYSEC-2026-2072 - ZenML Server Remote Privilege Escalation Vulnerability](https://junglewise.ai/threats/cve-2024-25723-zenml-server-remote-privilege-escalation-vulnerability) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-9340: ZenML unauthenticated DoS via Multipart Boundry](https://junglewise.ai/threats/cve-2024-9340-zenml-unauthenticated-dos-via-multipart-boundry) (low, CVSS 3, published 20 Mar 2025) - [CVE-2024-5062: ZenML reflected cross-site scripting in survey redirect](https://junglewise.ai/threats/cve-2024-5062-zenml-reflected-cross-site-scripting-in-survey-redirect) (low, CVSS 3.1, published 30 Jun 2024) - [CVE-2024-2383: Clickjacking in zenml](https://junglewise.ai/threats/cve-2024-2383-clickjacking-in-zenml) (low, CVSS 3.1, published 6 Jun 2024) - [CVE-2024-2213: Improper authentication in zenml](https://junglewise.ai/threats/cve-2024-2213-improper-authentication-in-zenml) (low, CVSS 3.1, published 6 Jun 2024) - [CVE-2024-2171: PYSEC-2024-170 - A stored Cross-Site Scripting (XSS) vulnerability was identified in the zenml-io/zenml repository…](https://junglewise.ai/threats/cve-2024-2171-cross-site-scripting-in-zenml) (low, CVSS 3.1, published 6 Jun 2024) - [CVE-2024-2035: PYSEC-2024-169 - An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the…](https://junglewise.ai/threats/cve-2024-2035-improper-authorization-in-zenml) (low, CVSS 3.1, published 6 Jun 2024) - [CVE-2024-2032: Race condition in zenml](https://junglewise.ai/threats/cve-2024-2032-race-condition-in-zenml) (low, CVSS 3.1, published 6 Jun 2024) - [CVE-2024-2260: zenml Session Fixation vulnerability](https://junglewise.ai/threats/cve-2024-2260-zenml-session-fixation-vulnerability) (low, CVSS 3.1, published 16 Apr 2024) - [CVE-2024-2083: Directory traversal in zenml](https://junglewise.ai/threats/cve-2024-2083-directory-traversal-in-zenml) (low, CVSS 3.1, published 16 Apr 2024) ## Most severe zenml (PyPI) vulnerabilities - [CVE-2024-25723: PYSEC-2026-2072 - ZenML Server Remote Privilege Escalation Vulnerability](https://junglewise.ai/threats/cve-2024-25723-zenml-server-remote-privilege-escalation-vulnerability) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-2083: Directory traversal in zenml](https://junglewise.ai/threats/cve-2024-2083-directory-traversal-in-zenml) (low, CVSS 3.1, published 16 Apr 2024) - [CVE-2024-2035: PYSEC-2024-169 - An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the…](https://junglewise.ai/threats/cve-2024-2035-improper-authorization-in-zenml) (low, CVSS 3.1, published 6 Jun 2024) - [CVE-2024-4311: PYSEC-2026-2070 - Missing ratelimit on passwrod resets in zenml](https://junglewise.ai/threats/cve-2024-4311-missing-ratelimit-on-passwrod-resets-in-zenml) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-2260: zenml Session Fixation vulnerability](https://junglewise.ai/threats/cve-2024-2260-zenml-session-fixation-vulnerability) (low, CVSS 3.1, published 16 Apr 2024) - [CVE-2024-5062: ZenML reflected cross-site scripting in survey redirect](https://junglewise.ai/threats/cve-2024-5062-zenml-reflected-cross-site-scripting-in-survey-redirect) (low, CVSS 3.1, published 30 Jun 2024) - [CVE-2024-2171: PYSEC-2024-170 - A stored Cross-Site Scripting (XSS) vulnerability was identified in the zenml-io/zenml repository…](https://junglewise.ai/threats/cve-2024-2171-cross-site-scripting-in-zenml) (low, CVSS 3.1, published 6 Jun 2024) - [CVE-2024-2383: Clickjacking in zenml](https://junglewise.ai/threats/cve-2024-2383-clickjacking-in-zenml) (low, CVSS 3.1, published 6 Jun 2024) - [CVE-2024-2032: Race condition in zenml](https://junglewise.ai/threats/cve-2024-2032-race-condition-in-zenml) (low, CVSS 3.1, published 6 Jun 2024) - [CVE-2024-2213: Improper authentication in zenml](https://junglewise.ai/threats/cve-2024-2213-improper-authentication-in-zenml) (low, CVSS 3.1, published 6 Jun 2024) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other PyPI technologies - [tensorflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-tensorflow): 435 vulnerabilities - [tensorflow-cpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-cpu): 430 vulnerabilities - [tensorflow-gpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-gpu): 427 vulnerabilities - [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui): 177 vulnerabilities - [Django (PyPI)](https://junglewise.ai/threats/technologies/django): 173 vulnerabilities - [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow): 159 vulnerabilities - [pillow (PyPI)](https://junglewise.ai/threats/technologies/pillow): 125 vulnerabilities - [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai): 120 vulnerabilities - [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm): 117 vulnerabilities - [plone (PyPI)](https://junglewise.ai/threats/technologies/pypi-plone): 101 vulnerabilities - [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow): 88 vulnerabilities - [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan): 86 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "zenml (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/pypi-zenml, 13 November 2026.