gradio-app gradio

• CVE-2026-59806 High 7.4 Gradio < 6.20.0 - Open Redirect and SSRF via /gradio_api/file= endpoint 0.4%
• CVE-2026-49119 High 7.5 Gradio < 6.16.0 Path Traversal via FileExplorer.preprocess() 0.7%
• CVE-2026-10783 Low 2.5 gradio-app gradio Audio Cache Key save_audio_to_cache weak hash 0.1%
• CVE-2026-48545 Medium 6.8 Gradio < 6.15.0 Cookie Injection via Shared Proxy Client 0.4%
• CVE-2026-28416 High 8.2 Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing 7.3%
• CVE-2026-28415 Medium 4.3 Gradio has Open Redirect in OAuth Flow 0.3%
• CVE-2026-28414 High 7.5 Gradio has Absolute Path Traversal on Windows with Python 3.13+ 3.1%
• CVE-2026-27167 None 0.0 Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret 0.5%
• CVE-2025-48889 Medium 5.3 Gradio Allows Unauthorized File Copy via Path Manipulation 0.7%
• CVE-2025-5320 Low 3.7 gradio-app gradio CORS is_valid_origin privilege escalation 0.3%
• CVE-2025-23042 High 8.7 Gradio Blocked Path ACL Bypass Vulnerability 1.0%
• CVE-2024-51751 Medium 6.5 Arbitrary file read with File and UploadButton components in Gradio 0.7%
• CVE-2024-47867 Low 2.1 Lack of integrity check on the downloaded FRP client in Gradio 0.2%
• CVE-2024-47868 Medium 6.3 Several components’ post-process steps may allow arbitrary file leaks in Gradio 0.8%
• CVE-2024-47869 Low 2.3 Non-constant-time comparison when comparing hashes in Gradio 0.3%
• CVE-2024-47870 High 7.1 Race condition in update_root_in_config may redirect user traffic in Gradio 0.4%
• CVE-2024-47871 High 8.2 Insecure communication between the FRP client and server in Gradio 0.2%
• CVE-2024-47872 Medium 6.9 Cross-site Scripting on Gradio server via upload of HTML files, JS files, or SVG files 0.3%
• CVE-2024-47084 Medium 6.9 CORS origin validation is not performed when the request has a cookie in Gradio 0.5%
• CVE-2024-47164 Low 2.3 The `is_in_or_equal` function may be bypassed in Gradio 0.7%
• CVE-2024-47165 Medium 6.9 CORS origin validation accepts the null origin in Gradio 0.3%
• CVE-2024-47166 Low 2.3 One-level read path traversal in `/custom_component` in Gradio 0.4%
• CVE-2024-47167 Medium 6.9 SSRF in the path parameter of /queue/join in Gradio 0.5%
• CVE-2024-47168 Low 2.3 The `enable_monitoring` flag set to `False` does not disable monitoring in Gradio 0.3%
• CVE-2023-51449 Medium 5.6 Make the `/file` secure against file traversal attacks 28.3%
• CVE-2023-34239 High 7.3 Unfiltered paths in gradio 0.7%
• CVE-2023-25823 Medium 5.4 Gradio contains Use of Hard-coded Credentials 0.6%
• CVE-2022-24770 High 8.8 Improper Neutralization of Formula Elements in a CSV File in Gradio Flagging 1.3%
• CVE-2021-43831 High 7.7 Files on the host computer can be accessed from the Gradio interface 3.9%