https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 20:00:09 +0000 https://cve.radiocsirt.org/vuln/cve-2026-28416 <p><strong>Affected:</strong> gradio-app gradio</p> <p>Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, a Server-Side Request Forgery (SSRF) vulnerability in Gradio allows an attacker to make arbitrary HTTP requests from a victim&#39;s server by hosting a malicious Gradio Space. When a victim application uses `gr.load()` to load an attacker-controlled Space, the malicious `proxy_url` from the config is trusted and added to the allowlist, enabling the attacker to access internal services, cloud metadata endpoints, and private networks through the victim&#39;s infrastructure. Version 6.6.0 fixes the issue.</p> <p><strong>Affected:</strong> gradio-app gradio</p> <p>Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, a Server-Side Request Forgery (SSRF) vulnerability in Gradio allows an attacker to make arbitrary HTTP requests from a victim&#39;s server by hosting a malicious Gradio Space. When a victim application uses `gr.load()` to load an attacker-controlled Space, the malicious `proxy_url` from the config is trusted and added to the allowlist, enabling the attacker to access internal services, cloud metadata endpoints, and private networks through the victim&#39;s infrastructure. Version 6.6.0 fixes the issue.</p> https://cve.radiocsirt.org/vuln/cve-2026-28416