PYSEC-2026-1423 Gradio CORS Origin Validation Bypass Vulnerability

A vulnerability classified as problematic has been found in gradio-app gradio up to 5.29.1. This affects the function isvalidorigin of the component CORS Handler. The manipulation of the argument localhostaliases leads to origin validation error. It is possible to initiate the attack remotely. Th...

archivebox (>=0.4.6, <=0.4.21), autoneuro-pypi (1.0.0) +9 more potentially affected by CVE-2026-48588 via django (3.0.8)

django PYPI version 3.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - archivebox =0.4.6, =0.1.3, =1.2.0, =0.3.1, =1.0.1, =0.6.11, =0.9.1 Source cves: CVE-2026-48588 Source advisory: OSV:GHSA-3H9F-R86X-QVJX...

archivebox (>=0.4.6, <=0.4.21), autoneuro-pypi (1.0.0) +9 more potentially affected by CVE-2026-53877 via django (3.0.8)

django PYPI version 3.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - archivebox =0.4.6, =0.1.3, =1.2.0, =0.3.1, =1.0.1, =0.6.11, =0.9.1 Source cves: CVE-2026-53877 Source advisory: OSV:GHSA-CRHF-3PFG-W68W...

GO-2026-5869 Rancher has over-inclusive team membership expansion in GitHub App authentication provider in github.com/rancher/rancher

Rancher has over-inclusive team membership expansion in GitHub App authentication provider in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

GO-2026-5909 Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder...

cradle-app (>=0.1.0, <=0.1.1) potentially affected by CVE-2024-8966 via gradio (1.7.7)

gradio PYPI version 1.7.7 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - cradle-app =0.1.0, =0.1.1 Source cves: CVE-2024-8966 Source advisory: OSV:PYSEC-2026-1410...

cradle-app (>=0.1.0, <=0.1.1) potentially affected by CVE-2024-8021 via gradio (1.7.7)

gradio PYPI version 1.7.7 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - cradle-app =0.1.0, =0.1.1 Source cves: CVE-2024-8021 Source advisory: OSV:PYSEC-2026-1411...

PyTorch Lightning denial of service vulnerability

A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the /api/v1/state endpoint of LightningApp. This issue occurs due to improper handling of unexpected state values, which results in the server...

PYSEC-2026-1857 PyTorch Lightning denial of service vulnerability

A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the /api/v1/state endpoint of LightningApp. This issue occurs due to improper handling of unexpected state values, which results in the server...

PYSEC-2026-1411 Gradio Vulnerable to Open Redirect

An open redirect vulnerability exists in the latest version of gradio-app/gradio. The vulnerability allows an attacker to redirect users to a malicious website by URL encoding. This can be exploited by sending a crafted request to the application, which results in a 302 redirect to an...

cradle-app (>=0.1.0, <=0.1.1) potentially affected by CVE-2024-12217 via gradio (1.7.7)

gradio PYPI version 1.7.7 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - cradle-app =0.1.0, =0.1.1 Source cves: CVE-2024-12217 Source advisory: OSV:PYSEC-2026-1418...

PYSEC-2026-1289 DB-GPT vulnerable to Cross-Site Request Forgery

In version 0.6.0 of eosphoros-ai/db-gpt, the uvicorn app created by dbgptserver uses an overly permissive instance of CORSMiddleware which sets the Access-Control-Allow-Origin to for all requests. This configuration makes all endpoints exposed by the server vulnerable to Cross-Site Request Forger...

MobSF Partial Denial of Service (DoS)

Partial Denial of Service DoSProduct: MobSFVersion: v4.2.9CWE-ID: CWE-1287: Improper Validation of Specified Type of InputCVSS vector v.4.0: 6.9 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NCVSS vector v.3.1: 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HDescription: DoS in the Scans Results an...

animo-trainer (1.0.2), ankml (>=1.0.1, <=1.0.7) +31 more potentially affected by CVE-2024-49766 via werkzeug (2.3.7)

werkzeug PYPI version 2.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - animo-trainer 1.0.2 - ankml =1.0.1, =0.9.5, =3.2.0, =1.0.5, =0.2.18, =1.0.0, =0.1.0, =2.0.0, =1.0.1, =1.0.4 and more Source cves: CVE-2024-49766...

cradle-app (>=0.1.0, <=0.1.1) potentially affected by CVE-2024-48052 via gradio (1.7.7)

gradio PYPI version 1.7.7 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - cradle-app =0.1.0, =0.1.1 Source cves: CVE-2024-48052 Source advisory: OSV:PYSEC-2026-1408...

archivebox (>=0.4.6, <=0.4.21), autoneuro-pypi (1.0.0) +9 more potentially affected by CVE-2024-45231 via django (3.0.8)

django PYPI version 3.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - archivebox =0.4.6, =0.1.3, =1.2.0, =0.3.1, =1.0.1, =0.6.11, =0.9.1 Source cves: CVE-2024-45231 Source advisory: OSV:PYSEC-2026-1297...

carml (19.1.0), nucypher (>=0.1.0a27, <=1.2.0b1) +3 more potentially affected by CVE-2024-41671 via twisted (19.7.0)

twisted PYPI version 19.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - carml 19.1.0 - nucypher =0.1.0a27, =1.1.0, =1.0.0, =0.2.0, =0.2.1 Source cves: CVE-2024-41671 Source advisory: OSV:PYSEC-2026-1992...

an-website (>=22.5.20, <=22.6.10), carml (>=22.7.0, <=22.7.1) +4 more potentially affected by CVE-2024-6345 via setuptools (62.3.2)

setuptools PYPI version 62.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - an-website =22.5.20, =22.7.0, =2.1.5a1, =0.0.0, =2.3.0rc3 Source cves: CVE-2024-6345 Source advisory: OSV:PYSEC-2026-1918...

amusing-app (>=0.1.0, <=0.1.2), mamkit (>=0.1.0, <=1.0.1) +3 more potentially affected by CVE-2024-38519 via yt-dlp (2023.11.16)

yt-dlp PYPI version 2023.11.16 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - amusing-app =0.1.0, =0.1.0, =1.3.2, =0.0.1, =2023.11.16, =2024.1.5.post4 Source cves: CVE-2024-38519 Source advisory: OSV:PYSEC-2026-2065...

Open redirect in gradio

An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting XSS, Server-Side Request Forgery SSRF, amongst others. This...