Ggradio-app

Products

Exploited and recent CVEs

• CVE-2026-59806 High 7.4 Gradio < 6.20.0 - Open Redirect and SSRF via /gradio_api/file= endpoint 0.4%
• CVE-2026-49119 High 7.5 Gradio < 6.16.0 Path Traversal via FileExplorer.preprocess() 0.7%
• CVE-2026-10783 Low 2.5 gradio-app gradio Audio Cache Key save_audio_to_cache weak hash 0.1%
• CVE-2026-48545 Medium 6.8 Gradio < 6.15.0 Cookie Injection via Shared Proxy Client 0.4%
• CVE-2026-28416 High 8.2 Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing 7.3%
• CVE-2026-28415 Medium 4.3 Gradio has Open Redirect in OAuth Flow 0.3%
• CVE-2026-28414 High 7.5 Gradio has Absolute Path Traversal on Windows with Python 3.13+ 3.1%
• CVE-2026-27167 None 0.0 Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret 0.5%
• CVE-2025-48889 Medium 5.3 Gradio Allows Unauthorized File Copy via Path Manipulation 0.7%
• CVE-2025-5320 Low 3.7 gradio-app gradio CORS is_valid_origin privilege escalation 0.3%
• CVE-2024-8021 Medium 5.4 Open Redirect in gradio-app/gradio 0.8%
• CVE-2024-10648 High 8.2 Path Traversal in gradio-app/gradio 0.7%
• CVE-2024-12217 Medium 5.3 Path Traversal in gradio-app/gradio 0.7%
• CVE-2024-8966 High 7.5 Denial of Service in gradio-app/gradio 0.8%
• CVE-2024-10569 High 7.5 Zip Bomb Vulnerability in gradio-app/gradio 0.7%
• CVE-2024-10624 High 7.5 Regular Expression Denial of Service (ReDoS) in gradio-app/gradio 1.1%
• CVE-2025-0187 High 7.5 Denial of Service (DoS) by Sending Large Filename at File Upload Endpoint in gradio-app/gradio 0.7%
• CVE-2025-23042 High 8.7 Gradio Blocked Path ACL Bypass Vulnerability 1.0%
• CVE-2024-51751 Medium 6.5 Arbitrary file read with File and UploadButton components in Gradio 0.7%
• CVE-2024-47867 Low 2.1 Lack of integrity check on the downloaded FRP client in Gradio 0.2%
• CVE-2024-47868 Medium 6.3 Several components’ post-process steps may allow arbitrary file leaks in Gradio 0.8%
• CVE-2024-47869 Low 2.3 Non-constant-time comparison when comparing hashes in Gradio 0.3%
• CVE-2024-47870 High 7.1 Race condition in update_root_in_config may redirect user traffic in Gradio 0.4%
• CVE-2024-47871 High 8.2 Insecure communication between the FRP client and server in Gradio 0.2%
• CVE-2024-47872 Medium 6.9 Cross-site Scripting on Gradio server via upload of HTML files, JS files, or SVG files 0.3%
• CVE-2024-47084 Medium 6.9 CORS origin validation is not performed when the request has a cookie in Gradio 0.5%
• CVE-2024-47164 Low 2.3 The `is_in_or_equal` function may be bypassed in Gradio 0.7%
• CVE-2024-47165 Medium 6.9 CORS origin validation accepts the null origin in Gradio 0.3%
• CVE-2024-47166 Low 2.3 One-level read path traversal in `/custom_component` in Gradio 0.4%
• CVE-2024-47167 Medium 6.9 SSRF in the path parameter of /queue/join in Gradio 0.5%