CVE-2026-28415

Gradio prior to 6.6.0 exposes an open redirect in the OAuth flow: _redirect_to_target() accepts an unvalidated _target_url, enabling redirection to arbitrary external URLs via /logout and /login/callback for apps using gr.LoginButton (e.g., Hugging Face Spaces). Starting with 6.6.0, the _target_u...

Spaces - Find, discuss, do - BSD license, Customized SSL vulnerabilities

HackApp vulnerability scanner discovered that application Spaces - Find, discuss, do published at the 'play' market has multiple vulnerabilities...