draggan (1.1.6), fast-tts (0.0.3) +2 more potentially affected by CVE-2024-8966 via gradio (3.34.0)

gradio PYPI version 3.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - draggan 1.1.6 - fast-tts 0.0.3 - kaggle-deps 0.1.0 - oobabot-plugin =0.2.0, =0.2.2 Source cves: CVE-2024-8966 Source advisory: OSV:GHSA-5CPQ-9538-J...

africanwhisper (>=0.2.6, <=0.9.0), ominix-tts (0.1.0) potentially affected by CVE-2024-8966 via gradio (4.24.0)

gradio PYPI version 4.24.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - africanwhisper =0.2.6, =0.9.0 - ominix-tts 0.1.0 Source cves: CVE-2024-8966 Source advisory: OSV:GHSA-5CPQ-9538-JM2J...

cosyvoice-package (0.0.2), matcha-tts (>=0.0.7.1, <=0.0.7.2) +1 more potentially affected by CVE-2024-8966 via gradio (3.43.2)

gradio PYPI version 3.43.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - cosyvoice-package 0.0.2 - matcha-tts =0.0.7.1, =0.0.7.2 - matcha-tts-package 0.0.1 Source cves: CVE-2024-8966 Source advisory: OSV:GHSA-5CPQ-9538-J...

draggan (1.1.6), fast-tts (0.0.3) +2 more potentially affected by CVE-2024-8021 via gradio (3.34.0)

gradio PYPI version 3.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - draggan 1.1.6 - fast-tts 0.0.3 - kaggle-deps 0.1.0 - oobabot-plugin =0.2.0, =0.2.2 Source cves: CVE-2024-8021 Source advisory: OSV:GHSA-7V2W-H4GH-W...

cosyvoice-package (0.0.2), matcha-tts (>=0.0.7.1, <=0.0.7.2) +1 more potentially affected by CVE-2024-8021 via gradio (3.43.2)

gradio PYPI version 3.43.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - cosyvoice-package 0.0.2 - matcha-tts =0.0.7.1, =0.0.7.2 - matcha-tts-package 0.0.1 Source cves: CVE-2024-8021 Source advisory: OSV:GHSA-7V2W-H4GH-W...

viet-tts (0.1.0) potentially affected by CVE-2024-12217 via gradio (4.32.2)

gradio PYPI version 4.32.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - viet-tts 0.1.0 Source cves: CVE-2024-12217 Source advisory: OSV:GHSA-PRPG-P95C-32FV...

africanwhisper (>=0.2.6, <=0.9.0), ominix-tts (0.1.0) potentially affected by CVE-2024-12217 via gradio (4.24.0)

gradio PYPI version 4.24.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - africanwhisper =0.2.6, =0.9.0 - ominix-tts 0.1.0 Source cves: CVE-2024-12217 Source advisory: OSV:GHSA-PRPG-P95C-32FV...

cosyvoice-package (0.0.2), matcha-tts (>=0.0.7.1, <=0.0.7.2) +1 more potentially affected by CVE-2024-12217 via gradio (3.43.2)

gradio PYPI version 3.43.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - cosyvoice-package 0.0.2 - matcha-tts =0.0.7.1, =0.0.7.2 - matcha-tts-package 0.0.1 Source cves: CVE-2024-12217 Source advisory:...

draggan (1.1.6), fast-tts (0.0.3) +2 more potentially affected by CVE-2024-12217 via gradio (3.34.0)

gradio PYPI version 3.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - draggan 1.1.6 - fast-tts 0.0.3 - kaggle-deps 0.1.0 - oobabot-plugin =0.2.0, =0.2.2 Source cves: CVE-2024-12217 Source advisory:...

CVE-2024-12779

A Server-Side Request Forgery SSRF vulnerability exists in infiniflow/ragflow version 0.12.0. The vulnerability is present in the "POST /v1/llm/addllm" and "POST /v1/conversation/tts" endpoints. Attackers can specify an arbitrary URL as the "apibase" when adding an "OPENAITTS" model, and...

CVE-2024-12779: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF vulnerability exists in infiniflow/ragflow version 0.12.0. The vulnerability is present in the POST /v1/llm/addllm and POST /v1/conversation/tts endpoints. Attackers can specify an arbitrary URL as the apibase when adding an OPENAITTS model, and subsequently...

PT-2025-12148

Name of the Vulnerable Software and Affected Versions infiniflow/ragflow version 0.12.0 Description A Server-Side Request Forgery SSRF issue exists, allowing attackers to specify an arbitrary URL as the api base when adding an OPENAITTS model. This can lead to unauthorized access to internal web...

PT-2025-11986

Name of the Vulnerable Software and Affected Versions Applio versions 3.2.8-bugfix and prior Description The issue concerns arbitrary file removal in the core.py component. The output tts path variable in tts.py accepts arbitrary user input, which is then passed to the run tts script function in...

viet-tts (0.1.0) potentially affected by CVE-2025-23042 via gradio (4.32.2)

gradio PYPI version 4.32.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - viet-tts 0.1.0 Source cves: CVE-2025-23042 Source advisory: OSV:PYSEC-2025-118...

africanwhisper (>=0.2.6, <=0.9.0), ominix-tts (0.1.0) potentially affected by CVE-2025-23042 via gradio (4.24.0)

gradio PYPI version 4.24.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - africanwhisper =0.2.6, =0.9.0 - ominix-tts 0.1.0 Source cves: CVE-2025-23042 Source advisory: OSV:PYSEC-2025-118...

cosyvoice-package (0.0.2), matcha-tts (>=0.0.7.1, <=0.0.7.2) +1 more potentially affected by CVE-2025-23042 via gradio (3.43.2)

gradio PYPI version 3.43.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - cosyvoice-package 0.0.2 - matcha-tts =0.0.7.1, =0.0.7.2 - matcha-tts-package 0.0.1 Source cves: CVE-2025-23042 Source advisory: OSV:PYSEC-2025-118...

draggan (1.1.6), fast-tts (0.0.3) +2 more potentially affected by CVE-2025-23042 via gradio (3.34.0)

gradio PYPI version 3.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - draggan 1.1.6 - fast-tts 0.0.3 - kaggle-deps 0.1.0 - oobabot-plugin =0.2.0, =0.2.2 Source cves: CVE-2025-23042 Source advisory: OSV:PYSEC-2025-118...

viet-tts (0.1.0) potentially affected by CVE-2025-23042 via gradio (4.32.2)

gradio PYPI version 4.32.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - viet-tts 0.1.0 Source cves: CVE-2025-23042 Source advisory: OSV:GHSA-J2JG-FQ62-7C3H...

africanwhisper (>=0.2.6, <=0.9.0), ominix-tts (0.1.0) potentially affected by CVE-2025-23042 via gradio (4.24.0)

gradio PYPI version 4.24.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - africanwhisper =0.2.6, =0.9.0 - ominix-tts 0.1.0 Source cves: CVE-2025-23042 Source advisory: OSV:GHSA-J2JG-FQ62-7C3H...

cosyvoice-package (0.0.2), matcha-tts (>=0.0.7.1, <=0.0.7.2) +1 more potentially affected by CVE-2025-23042 via gradio (3.43.2)

gradio PYPI version 3.43.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - cosyvoice-package 0.0.2 - matcha-tts =0.0.7.1, =0.0.7.2 - matcha-tts-package 0.0.1 Source cves: CVE-2025-23042 Source advisory:...