214 matches found
GHSA-F2FF-P2WW-7P4P vulnerabilities
Vulnerabilities for packages: label-studio, airflow, openstack-glance-2025.2-fips, authentik, pgadmin4, mycli, openstack-horizon-2026.1-fips, openstack-nova-2025.2, openstack-glance-2026.1-fips, dbt-bigquery, openstack-placement-2025.1-fips, openstack-keystone-2026.1-fips,...
CVE-2026-72560
A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRFPROTECTIONENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback addresses on the default installation. An...
CVE-2026-72560 HumanSignal Label Studio - Server-Side Request Forgery
A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRFPROTECTIONENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback addresses on the default installation. An...
CVE-2026-72560
CVE-2026-72560 affects HumanSignal Label Studio (up to 1.24.0.dev0). The import-from-URL endpoint can fetch caller-supplied URLs, including internal loopback addresses, because SSRF_PROTECTION_ENABLED is false by default in the default installation. An authenticated user could use this to reach i...
EUVD-2026-56030
A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRFPROTECTIONENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback addresses on the default installation. An...
CVE-2026-72560
A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRFPROTECTIONENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback addresses on the default installation. An...
PT-2026-70135
Name of the Vulnerable Software and Affected Versions HumanSignal Label Studio versions prior to 1.24.0.dev0 Description An authenticated user can perform a server-side request forgery SSRF because the SSRF PROTECTION ENABLED variable is set to false by default. This allows the 'import-from-URL'...
GHSA-8359-H9FX-J6V9 vulnerabilities
Vulnerabilities for packages: label-studio...
CVE-2026-54691 vulnerabilities
Vulnerabilities for packages: label-studio...
GHSA-R5VV-FF45-PRP2 vulnerabilities
Vulnerabilities for packages: label-studio...
GHSA-954P-556P-R752 vulnerabilities
Vulnerabilities for packages: label-studio...
CVE-2026-55391 vulnerabilities
Vulnerabilities for packages: label-studio...
CVE-2026-55403 vulnerabilities
Vulnerabilities for packages: label-studio...
CVE-2026-55415 vulnerabilities
Vulnerabilities for packages: label-studio...
GHSA-386Q-5HP3-95M9 vulnerabilities
Vulnerabilities for packages: label-studio...
GHSA-WJV6-JCFJ-MF9R vulnerabilities
Vulnerabilities for packages: label-studio...
CVE-2026-54654 vulnerabilities
Vulnerabilities for packages: label-studio...
CVE-2026-54621 vulnerabilities
Vulnerabilities for packages: label-studio...