PYSEC-2026-1417 Gradio Vulnerable to Arbitrary File Deletion

A path traversal vulnerability exists in the Gradio Audio component of gradio-app/gradio, as of version git 98cbcae. This vulnerability allows an attacker to control the format of the audio file, leading to arbitrary file content deletion. By manipulating the output format, an attacker can reset...

harmonai-tools (>=0.0.6, <=0.0.7), stable-audio-tools (>=0.0.7, <=0.0.10) potentially affected by CVE-2024-48052 via gradio (3.42.0)

gradio PYPI version 3.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - harmonai-tools =0.0.6, =0.0.7, =0.0.10 Source cves: CVE-2024-48052 Source advisory: OSV:PYSEC-2026-1408...

harmonai-tools (>=0.0.6, <=0.0.7), stable-audio-tools (>=0.0.7, <=0.0.10) potentially affected by CVE-2024-4940 via gradio (3.42.0)

gradio PYPI version 3.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - harmonai-tools =0.0.6, =0.0.7, =0.0.10 Source cves: CVE-2024-4940 Source advisory: OSV:PYSEC-2026-1414...

PYSEC-2026-1588 lollms vulnerable to path traversal due to unauthenticated root folder settings change

A path traversal vulnerability exists in the XTTS server included in the lollms package, version v9.6. This vulnerability arises from the ability to perform an unauthenticated root folder settings change. Although the read file endpoint is protected against path traversals, this protection can be...

Arbitrary file deletion in litellm

BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on the /audio/transcriptions endpoint. An attacker can exploit this vulnerability by sending a specially crafted request that includes a file path to the server, which then deletes...

PYSEC-2026-1540 Arbitrary file deletion in litellm

BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on the /audio/transcriptions endpoint. An attacker can exploit this vulnerability by sending a specially crafted request that includes a file path to the server, which then deletes...

harmonai-tools (>=0.0.6, <=0.0.7), stable-audio-tools (>=0.0.7, <=0.0.10) potentially affected by CVE-2024-4325 via gradio (3.42.0)

gradio PYPI version 3.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - harmonai-tools =0.0.6, =0.0.7, =0.0.10 Source cves: CVE-2024-4325 Source advisory: OSV:PYSEC-2026-1413...

harmonai-tools (>=0.0.6, <=0.0.7), stable-audio-tools (>=0.0.7, <=0.0.10) potentially affected by CVE-2024-1727 via gradio (3.42.0)

gradio PYPI version 3.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - harmonai-tools =0.0.6, =0.0.7, =0.0.10 Source cves: CVE-2024-1727 Source advisory: OSV:PYSEC-2026-1409...

harmonai-tools (>=0.0.6, <=0.0.7), stable-audio-tools (>=0.0.7, <=0.0.10) potentially affected by CVE-2024-34511 via gradio (3.42.0)

gradio PYPI version 3.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - harmonai-tools =0.0.6, =0.0.7, =0.0.10 Source cves: CVE-2024-34511 Source advisory: OSV:PYSEC-2026-1407...

harmonai-tools (>=0.0.6, <=0.0.7), stable-audio-tools (>=0.0.7, <=0.0.10) potentially affected by CVE-2024-1561 via gradio (3.42.0)

gradio PYPI version 3.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - harmonai-tools =0.0.6, =0.0.7, =0.0.10 Source cves: CVE-2024-1561 Source advisory: OSV:PYSEC-2026-1415...

harmonai-tools (>=0.0.6, <=0.0.7), stable-audio-tools (>=0.0.7, <=0.0.10) potentially affected by CVE-2024-1183 via gradio (3.42.0)

gradio PYPI version 3.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - harmonai-tools =0.0.6, =0.0.7, =0.0.10 Source cves: CVE-2024-1183 Source advisory: OSV:PYSEC-2026-1419...

harmonai-tools (>=0.0.6, <=0.0.7), stable-audio-tools (>=0.0.7, <=0.0.10) potentially affected by CVE-2024-2206 via gradio (3.42.0)

gradio PYPI version 3.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - harmonai-tools =0.0.6, =0.0.7, =0.0.10 Source cves: CVE-2024-2206 Source advisory: OSV:PYSEC-2026-1420...

harmonai-tools (>=0.0.6, <=0.0.7), stable-audio-tools (>=0.0.7, <=0.0.10) potentially affected by CVE-2024-1729 via gradio (3.42.0)

gradio PYPI version 3.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - harmonai-tools =0.0.6, =0.0.7, =0.0.10 Source cves: CVE-2024-1729 Source advisory: OSV:PYSEC-2026-1416...

TensorFlow has Floating Point Exception in AudioSpectrogram

Impactversion:2.11.0 //core/ops/audioops.cc:70Status SpectrogramShapeFnInferenceContext c ShapeHandle input; TFRETURNIFERRORc-WithRankc-input0, 2, ; int32t windowsize; TFRETURNIFERRORc-GetAttr"windowsize", size; int32t stride; TFRETURNIFERRORc-GetAttr"stride", ; .....1DimensionHandle inputlength ...

aggmap (>=1.1.1, <=1.2.1), animl (>=1.1.2, <=1.1.4) +54 more potentially affected by CVE-2023-25673 via tensorflow-gpu (>=2.0.0, <=2.10.1)

tensorflow-gpu PYPI version =2.0.0, =1.1.1, =1.1.2, =0.0.1, =0.0.9, =0.2.1, =0.1.0, =0.0.4, =1.1.1, =1.1.0, =0.1.1, =0.3.2 and more Source cves: CVE-2023-25673 Source advisory: OSV:PYSEC-2026-956...

animl (>=1.1.2, <=1.1.4), audio-classification-models (1.0.1) +50 more potentially affected by CVE-2022-41897 via tensorflow-gpu (>=2.0.0, <=2.8.3)

tensorflow-gpu PYPI version =2.0.0, =1.1.2, =0.0.1, =0.0.9, =0.2.1, =0.1.0, =0.0.4, =1.1.1, =1.1.0, =0.1.1, =0.1.0, =0.1.7 and more Source cves: CVE-2022-41897 Source advisory: OSV:PYSEC-2026-984...

animl (>=1.1.2, <=1.1.4), audio-classification-models (1.0.1) +44 more potentially affected by CVE-2022-35989 via tensorflow-gpu (>=2.0.0, <=2.7.0)

tensorflow-gpu PYPI version =2.0.0, =1.1.2, =0.0.1, =0.0.9, =0.0.4, =1.1.1, =1.1.0, =0.1.1, =0.1.0, =0.1.5, =0.2.0, =0.2.1 and more Source cves: CVE-2022-35989 Source advisory: OSV:PYSEC-2026-1011...

TensorFlow vulnerable to `CHECK` fail in `AudioSummaryV2`

ImpactWhen AudioSummaryV2 receives an input samplerate with more than one element, it gives a CHECK fails that can be used to trigger a denial of service attack.pythonimport tensorflow as tfarg0=''arg1=tf.random.uniformshape=1,1, dtype=tf.float32, maxval=Nonearg2=tf.random.uniformshape=2,1,...

PYSEC-2026-998 TensorFlow vulnerable to `CHECK` fail in `AudioSummaryV2`

Impact When AudioSummaryV2 receives an input samplerate with more than one element, it gives a CHECK fails that can be used to trigger a denial of service attack. python import tensorflow as tf arg0='' arg1=tf.random.uniformshape=1,1, dtype=tf.float32, maxval=None arg2=tf.random.uniformshape=2,1,...

firefox: thunderbird: Incorrect boundary conditions in the Web Audio component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the Web Audio component...