CVE-2026-85179 Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...

The vulnerability of the `createAnnotation` method in the library for creating PDF files using jsPDF allows a violator to execute arbitrary code.

The vulnerability of the createAnnotation method in the jsPDF library relates to improper encoding or escaping of output data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by injecting specially crafted PDF files...

CVE-2025-66497

A memory corruption vulnerability exists in the 3D annotation handling of Foxit PDF Reader due to insufficient bounds checking when parsing PRC data. When opening a PDF file containing malformed or specially crafted PRC content, out-of-bounds memory access may occur, resulting in memory corruptio...