airo-camera-toolkit (>=2025.4.0, <=2025.7.1), airo-dataset-tools (>=2025.4.0, <=2026.5.0) +35 more potentially affected by CVE-2026-107727 via strawberry-graphql (>=0.312.4, <=0.327.1)

strawberry-graphql PYPI version =0.312.4, =2025.4.0, =2025.4.0, =0.9.0, =26.4.0rc1, =0.1.0a1, =0.2.0, =1.0.1, =0.1.0, =1.17.0, =0.1.0, =0.0.246, =2.0.0, =0.0.1a0, =0.1.26, =1.1.3, =2.4.1 and more Source cves: CVE-2026-107727 Source advisory: OSV:GHSA-M952-2W3F-6R8H...

CVE-2026-80426

FiftyOne renders a dataset field's description as markup. The sidebar field-information component at app/packages/core/src/components/FieldLabelAndInfo/index.tsx passes the description string to React's dangerouslySetInnerHTML, and no layer between storage and render escapes or sanitises it; the...

CVE-2026-80426

FiftyOne (Voxel51) is vulnerable to stored cross-site scripting in versions before 1.21.0 . The sidebar field-information component at FieldLabelAndInfo/index.tsx passes a dataset field's description to React's dangerouslySetInnerHTML without escaping or sanitizing, making it the only raw render ...

CVE-2026-80426 FiftyOne before 1.21.0 Stored Cross-Site Scripting via Unescaped Field Description

FiftyOne renders a dataset field's description as markup. The sidebar field-information component at app/packages/core/src/components/FieldLabelAndInfo/index.tsx passes the description string to React's dangerouslySetInnerHTML, and no layer between storage and render escapes or sanitises it; the...

CVE-2026-80426 FiftyOne before 1.21.0 Stored Cross-Site Scripting via Unescaped Field Description

FiftyOne renders a dataset field's description as markup. The sidebar field-information component at app/packages/core/src/components/FieldLabelAndInfo/index.tsx passes the description string to React's dangerouslySetInnerHTML, and no layer between storage and render escapes or sanitises it; the...

CVE-2026-80426

FiftyOne renders a dataset field's description as markup. The sidebar field-information component at app/packages/core/src/components/FieldLabelAndInfo/index.tsx passes the description string to React's dangerouslySetInnerHTML, and no layer between storage and render escapes or sanitises it; the...

adelecv (>=0.0.1, <=0.0.2), artus (>=0.1.0, <=0.3.1) +11 more potentially affected by CVE-2026-80426 via fiftyone (>=0.16.5, <=1.17.0)

fiftyone PYPI version =0.16.5, =0.0.1, =0.1.0, =1.1.20, =0.1.0, =0.1.0, =0.0.0, =0.0.2, =0.3.8, =0.0.1rc5, =0.0.5, =0.1.0, =0.1.1 Source cves: CVE-2026-80426 Source advisory: MEND:CVE-2026-80426...

CVE-2026-80426 FiftyOne before 1.21.0 Stored Cross-Site Scripting via Unescaped Field Description

FiftyOne renders a dataset field's description as markup. The sidebar field-information component at app/packages/core/src/components/FieldLabelAndInfo/index.tsx passes the description string to React's dangerouslySetInnerHTML, and no layer between storage and render escapes or sanitises it; the...

EUVD-2026-66600

FiftyOne renders a dataset field's description as markup. The sidebar field-information component at app/packages/core/src/components/FieldLabelAndInfo/index.tsx passes the description string to React's dangerouslySetInnerHTML, and no layer between storage and render escapes or sanitises it; the...

CVE-2026-80426: Improper Neutralization of Input During Web Page Generation

FiftyOne renders a dataset field's description as markup. The sidebar field-information component at app/packages/core/src/components/FieldLabelAndInfo/index.tsx passes the description string to React's dangerouslySetInnerHTML, and no layer between storage and render escapes or sanitises it; the...

PT-2026-82212

Name of the Vulnerable Software and Affected Versions FiftyOne affected versions not specified Description The application renders a dataset field's description as markup without proper sanitization or escaping. Specifically, the sidebar field-information component located at...

CVE-2026-53656

FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyOne App/API server in fiftyone/server/app.py and the /media route in fiftyone/server/routes/media.py unconditionally return Access-Control-Allow-Origin: . Because the embedded...

CVE-2026-53656

FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyOne App/API server in fiftyone/server/app.py and the /media route in fiftyone/server/routes/media.py unconditionally return Access-Control-Allow-Origin: . Because the embedded...

CVE-2026-53656

FiftyOne (open-source visual AI dataset platform) versions prior to 1.17.0 unconditionally set Access-Control-Allow-Origin: * on its locally running, unauthenticated App/API server. Because the /media endpoint accepts a filesystem path parameter, a malicious website can issue cross-origin request...

adelecv (>=0.0.1, <=0.0.2), artus (>=0.1.0, <=0.3.1) +7 more potentially affected by CVE-2026-53656 via fiftyone (>=0.16.5, <=1.16.0)

fiftyone PYPI version =0.16.5, =0.0.1, =0.1.0, =1.1.20, =0.1.0, =0.1.0, =0.0.0, =0.0.2, =0.0.3 - pysolotools-fiftyone 0.3.25 Source cves: CVE-2026-53656 Source advisory: MEND:CVE-2026-53656...

EUVD-2026-64145

FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyOne App/API server in fiftyone/server/app.py and the /media route in fiftyone/server/routes/media.py unconditionally return Access-Control-Allow-Origin: . Because the embedded...

CVE-2026-53656 FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyOne App/API server in fiftyone/server/app.py and the /media route in fiftyone/server/routes/media.py unconditionally return Access-Control-Allow-Origin: . Because the embedded...

CVE-2026-53656 FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyOne App/API server in fiftyone/server/app.py and the /media route in fiftyone/server/routes/media.py unconditionally return Access-Control-Allow-Origin: . Because the embedded...

CVE-2026-53656 FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyOne App/API server in fiftyone/server/app.py and the /media route in fiftyone/server/routes/media.py unconditionally return Access-Control-Allow-Origin: . Because the embedded...

CVE-2026-53656: Origin Validation Error

FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyOne App/API server in fiftyone/server/app.py and the /media route in fiftyone/server/routes/media.py unconditionally return Access-Control-Allow-Origin: . Because the embedded...