xinference (>=0.10.1, <=0.14.4.post1) potentially affected by CVE-2026-28415 via gradio (4.26.0)

gradio PYPI version 4.26.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - xinference =0.10.1, =0.14.4.post1 Source cves: CVE-2026-28415 Source advisory: OSV:PYSEC-2026-65...

xinference (>=0.10.1, <=0.14.4.post1) potentially affected by CVE-2026-28416 via gradio (4.26.0)

gradio PYPI version 4.26.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - xinference =0.10.1, =0.14.4.post1 Source cves: CVE-2026-28416 Source advisory: OSV:PYSEC-2026-66...

iopaint (>=1.0.0b11, <=1.2.2), lisa-on-cuda (>=1.4.2, <=1.4.8) +4 more potentially affected by CVE-2026-28414 via gradio (5.1.0)

gradio PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - iopaint =1.0.0b11, =1.4.2, =0.2.0, =0.1.6, =0.15.0, =0.16.0 Source cves: CVE-2026-28414 Source advisory: OSV:PYSEC-2026-64...

bitwiseai (>=0.1.2, <=0.1.3), daggr (>=0.5.2, <=0.5.3) +3 more potentially affected by CVE-2026-28414 via gradio (>=6.0.0.dev5, <=6.4.0)

gradio PYPI version =6.0.0.dev5, =0.1.2, =0.5.2, =1.14.0, =2.12.0 Source cves: CVE-2026-28414 Source advisory: OSV:PYSEC-2026-64...

EUVD-2025-19750

Malicious code in bioql PyPI...

CVE-2025-45424

Incorrect access control in Xinference before v1.4.0 allows attackers to access the Web GUI without authentication...

CVE-2025-45424

Incorrect access control in Xinference before v1.4.0 allows attackers to access the Web GUI without authentication...

Missing Authentication for Critical Function

Overview xinference is a Xorbits InferenceXinference is a powerful and versatile library designed to serve language, speech recognition, and multimodal models. With Xorbits Inference, you can effortlessly deploy and serve your or state-of-the-art built-in models using just a single command. Wheth...

CVE-2025-45424

The Xinference library (versions prior to v1.4.0 ) is vulnerable to improper access control , which allows an attacker to access the Web GUI without any authentication. This flaw enables unauthorized access to sensitive functionality within the locally deployed interface. To remediate this issue,...

PT-2025-27660

Name of the Vulnerable Software and Affected Versions: Xinference versions prior to 1.4.0 Description: The issue is related to incorrect access control, allowing attackers to access the Web GUI without authentication. Recommendations: For versions prior to 1.4.0, update to version 1.4.0 or later ...

CVE-2025-45424: Improper Access Control

Incorrect access control in Xinference before v1.4.0 allows attackers to access the Web GUI without authentication...

CVE-2025-45424

Incorrect access control in Xinference before v1.4.0 allows attackers to access the Web GUI without authentication...

CVE-2025-45424

Incorrect access control in Xinference before v1.4.0 allows attackers to access the Web GUI without authentication...

CVE-2025-45424

Incorrect access control in Xinference before v1.4.0 allows attackers to access the Web GUI without authentication...

CVE-2025-45424

Incorrect access control in Xinference before v1.4.0 allows attackers to access the Web GUI without authentication...

Xinference security vulnerabilities

Xinference is an application by Endeavor's Xiao Yang Personal Developer. A security vulnerability exists in Xinference versions prior to 1.4.0, which stems from improper access control and could lead to unauthorized access to the Web GUI...

xinference (>=0.10.1, <=0.14.4.post1) potentially affected by CVE-2025-48889 via gradio (4.26.0)

gradio PYPI version 4.26.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - xinference =0.10.1, =0.14.4.post1 Source cves: CVE-2025-48889 Source advisory: OSV:GHSA-8JW3-6X8J-V96G...

Deserialization of Untrusted Data

Overview xinference is a Xorbits InferenceXinference is a powerful and versatile library designed to serve language, speech recognition, and multimodal models. With Xorbits Inference, you can effortlessly deploy and serve your or state-of-the-art built-in models using just a single command. Wheth...

CVE-2025-3622 Xorbits Inference model.py load deserialization

A vulnerability, which was classified as critical, has been found in Xorbits Inference up to 1.4.1. This issue affects the function load of the file xinference/thirdparty/cosyvoice/cli/model.py. The manipulation leads to deserialization...

CVE-2025-3622

A vulnerability, which was classified as critical, has been found in Xorbits Inference up to 1.4.1. This issue affects the function load of the file xinference/thirdparty/cosyvoice/cli/model.py. The manipulation leads to deserialization...