https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T00:16:30.612263+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-01839 bdu:2026-01839 2026-10-04T00:16:30.696672+00:00 bdu:2026-01839 https://cve.radiocsirt.org/vuln/euvd-2026-223911 EUVD-2026-223911 2026-10-04T00:16:30.696711+00:00 EUVD-2026-223911 https://cve.radiocsirt.org/vuln/fkie_cve-2024-12217 fkie_cve-2024-12217 2026-10-04T00:16:30.696727+00:00

A vulnerability in the gradio-app/gradio repository, version git 67e4044, allows for path traversal on Windows OS. The implementation of the blocked_path functionality, which is intended to disallow users from reading certain files, is flawed. Specifically, while the application correctly blocks access to paths like 'C:/tmp/secret.txt', it fails to block access when using NTFS Alternate Data Streams (ADS) syntax, such as 'C:/tmp/secret.txt::$DATA'. This flaw can lead to unauthorized reading of blocked file paths.

 https://cve.radiocsirt.org/vuln/ghsa-prpg-p95c-32fv GHSA-prpg-p95c-32fv — Gradio Path Traversal vulnerability 2026-10-04T00:16:30.696761+00:00

Affected: PyPI: gradio

A vulnerability in the gradio-app/gradio repository, version git 67e4044, allows for path traversal on Windows OS. The implementation of the blocked_path functionality, which is intended to disallow users from reading certain files, is flawed. Specifically, while the application correctly blocks access to paths like 'C:/tmp/secret.txt', it fails to block access when using NTFS Alternate Data Streams (ADS) syntax, such as 'C:/tmp/secret.txt::$DATA'. This flaw can lead to unauthorized reading of blocked file paths.

 https://cve.radiocsirt.org/vuln/pysec-2026-1418 PYSEC-2026-1418 — Gradio Path Traversal vulnerability 2026-10-04T00:16:30.696788+00:00

Affected: PyPI: gradio

A vulnerability in the gradio-app/gradio repository, version git 67e4044, allows for path traversal on Windows OS. The implementation of the blocked_path functionality, which is intended to disallow users from reading certain files, is flawed. Specifically, while the application correctly blocks access to paths like 'C:/tmp/secret.txt', it fails to block access when using NTFS Alternate Data Streams (ADS) syntax, such as 'C:/tmp/secret.txt::$DATA'. This flaw can lead to unauthorized reading of blocked file paths.