FiftyOne Panel - Detect

FiftyOne, an open-source dataset visualization and curation tool for computer vision workflows built by Voxel51, was detected. The app ships with no authentication by default, so any exposed instance directly served browsable dataset content images, labels, metadata to unauthenticated visitors. T...

PYSEC-2026-3465 FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

Impact The FiftyOne App/API server fiftyone/server/app.py and the /media route fiftyone/server/routes/media.py unconditionally set a permissive CORS header Access-Control-Allow-Origin: on their responses. Because the embedded App server runs locally and is unauthenticated, this allows any website...

artus (>=0.1.0, <=0.3.1), darwin-fiftyone (>=1.1.20, <=2.1.1) +1 more potentially affected by CVE-2026-53656 via fiftyone (>=1.1.0, <=1.16.0)

fiftyone PYPI version =1.1.0, =0.1.0, =1.1.20, =2.1.1 - pysolotools-fiftyone 0.3.25 Source cves: CVE-2026-53656 Source advisory: OSV:PYSEC-2026-3465...

finegrained (>=0.1.1, <=0.1.4) potentially affected by CVE-2026-53656 via fiftyone (0.21.6)

fiftyone PYPI version 0.21.6 is affected by a known vulnerability. The following packages have a transitive dependency on fiftyone and may be impacted: - finegrained =0.1.1, =0.1.4 Source cves: CVE-2026-53656 Source advisory: OSV:PYSEC-2026-3465...

irisml-tasks-fiftyone (0.0.0) potentially affected by CVE-2026-53656 via fiftyone (0.16.6)

fiftyone PYPI version 0.16.6 is affected by a known vulnerability. The following packages have a transitive dependency on fiftyone and may be impacted: - irisml-tasks-fiftyone 0.0.0 Source cves: CVE-2026-53656 Source advisory: OSV:PYSEC-2026-3465...

fiftyone-vertex-exporter (>=0.1.0, <=0.1.1), irisml-tasks-fiftyone (>=0.0.1, <=0.0.4) potentially affected by CVE-2026-53656 via fiftyone (0.25.2)

fiftyone PYPI version 0.25.2 is affected by a known vulnerability. The following packages have a transitive dependency on fiftyone and may be impacted: - fiftyone-vertex-exporter =0.1.0, =0.0.1, =0.0.4 Source cves: CVE-2026-53656 Source advisory: OSV:PYSEC-2026-3465...

lightning-pose (>=0.0.2, <=0.0.3) potentially affected by CVE-2026-53656 via fiftyone (0.20.1)

fiftyone PYPI version 0.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on fiftyone and may be impacted: - lightning-pose =0.0.2, =0.0.3 Source cves: CVE-2026-53656 Source advisory: OSV:PYSEC-2026-3465...

adelecv (>=0.0.1, <=0.0.2), finegrained (0.1.0) potentially affected by CVE-2026-53656 via fiftyone (0.19.1)

fiftyone PYPI version 0.19.1 is affected by a known vulnerability. The following packages have a transitive dependency on fiftyone and may be impacted: - adelecv =0.0.1, =0.0.2 - finegrained 0.1.0 Source cves: CVE-2026-53656 Source advisory: OSV:PYSEC-2026-3465...

hello2 (0.1.33) potentially affected by CVE-2026-53656 via fiftyone (0.16.5)

fiftyone PYPI version 0.16.5 is affected by a known vulnerability. The following packages have a transitive dependency on fiftyone and may be impacted: - hello2 0.1.33 Source cves: CVE-2026-53656 Source advisory: OSV:PYSEC-2026-3465...

FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

ImpactThe FiftyOne App/API server fiftyone/server/app.py and the /media route fiftyone/server/routes/media.py unconditionally set a permissive CORS header Access-Control-Allow-Origin: on their responses. Because the embedded App server runs locally and is unauthenticated, this allows any website ...

PT-2026-64077

Impact The FiftyOne App/API server fiftyone/server/app.py and the /media route fiftyone/server/routes/media.py unconditionally set a permissive CORS header Access-Control-Allow-Origin: on their responses. Because the embedded App server runs locally and is unauthenticated, this allows any website...

astra-assistants (>=2.3.0, <=2.4.5), fiftyone-mcp-server (>=0.1.0, <=0.1.2) +7 more potentially affected by CVE-2026-59950 via mcp (0.9.1)

mcp PYPI version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mcp and may be impacted: - astra-assistants =2.3.0, =0.1.0, =3.0.16, =0.0.4, =1.0.26, =1.0.35 Source cves: CVE-2026-59950 Source advisory: OSV:GHSA-VJ7Q-GJH5-988W...

artus (>=0.1.0, <=0.3.1), darwin-fiftyone (>=1.1.20, <=2.1.1) +1 more potentially affected by CVE-2026-53656 via fiftyone (>=1.1.0, <=1.16.0)

fiftyone PYPI version =1.1.0, =0.1.0, =1.1.20, =2.1.1 - pysolotools-fiftyone 0.3.25 Source cves: CVE-2026-53656 Source advisory: SNYK:PYTHON-FIFTYONE-18017905...

fiftyone-vertex-exporter (>=0.1.0, <=0.1.1), irisml-tasks-fiftyone (>=0.0.1, <=0.0.4) potentially affected by CVE-2026-53656 via fiftyone (0.25.2)

fiftyone PYPI version 0.25.2 is affected by a known vulnerability. The following packages have a transitive dependency on fiftyone and may be impacted: - fiftyone-vertex-exporter =0.1.0, =0.0.1, =0.0.4 Source cves: CVE-2026-53656 Source advisory: OSV:GHSA-Q78P-HJ9H-5466...

artus (>=0.1.0, <=0.3.1), darwin-fiftyone (>=1.1.20, <=2.1.1) +1 more potentially affected by CVE-2026-53656 via fiftyone (>=1.1.0, <=1.16.0)

fiftyone PYPI version =1.1.0, =0.1.0, =1.1.20, =2.1.1 - pysolotools-fiftyone 0.3.25 Source cves: CVE-2026-53656 Source advisory: GHSA-Q78P-HJ9H-5466...

GHSA-Q78P-HJ9H-5466 FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

Impact The FiftyOne App/API server fiftyone/server/app.py and the /media route fiftyone/server/routes/media.py unconditionally set a permissive CORS header Access-Control-Allow-Origin: on their responses. Because the embedded App server runs locally and is unauthenticated, this allows any website...

adelecv (>=0.0.1, <=0.0.2), finegrained (0.1.0) potentially affected by CVE-2026-53656 via fiftyone (0.19.1)

fiftyone PYPI version 0.19.1 is affected by a known vulnerability. The following packages have a transitive dependency on fiftyone and may be impacted: - adelecv =0.0.1, =0.0.2 - finegrained 0.1.0 Source cves: CVE-2026-53656 Source advisory: OSV:GHSA-Q78P-HJ9H-5466...

finegrained (>=0.1.1, <=0.1.4) potentially affected by CVE-2026-53656 via fiftyone (0.21.6)

fiftyone PYPI version 0.21.6 is affected by a known vulnerability. The following packages have a transitive dependency on fiftyone and may be impacted: - finegrained =0.1.1, =0.1.4 Source cves: CVE-2026-53656 Source advisory: OSV:GHSA-Q78P-HJ9H-5466...

lightning-pose (>=0.0.2, <=0.0.3) potentially affected by CVE-2026-53656 via fiftyone (0.20.1)

fiftyone PYPI version 0.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on fiftyone and may be impacted: - lightning-pose =0.0.2, =0.0.3 Source cves: CVE-2026-53656 Source advisory: OSV:GHSA-Q78P-HJ9H-5466...

irisml-tasks-fiftyone (0.0.0) potentially affected by CVE-2026-53656 via fiftyone (0.16.6)

fiftyone PYPI version 0.16.6 is affected by a known vulnerability. The following packages have a transitive dependency on fiftyone and may be impacted: - irisml-tasks-fiftyone 0.0.0 Source cves: CVE-2026-53656 Source advisory: OSV:GHSA-Q78P-HJ9H-5466...