385 matches found
CVE-2026-72560: Server-Side Request Forgery (SSRF)
A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRFPROTECTIONENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback addresses on the default installation. An...
PT-2026-70135
Name of the Vulnerable Software and Affected Versions HumanSignal Label Studio versions prior to 1.24.0.dev0 Description An authenticated user can perform a server-side request forgery SSRF because the SSRF PROTECTION ENABLED variable is set to false by default. This allows the 'import-from-URL'...
django-dragon (0.1.1), label-studio (>=1.3.0, <=1.4.0) potentially affected by CVE-2026-15307 via django (3.1.13)
django PYPI version 3.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-dragon 0.1.1 - label-studio =1.3.0, =1.4.0 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...
directory-constants (>=21.0.1, <=21.0.2), djongo (1.3.7) +2 more potentially affected by CVE-2026-15307 via django (3.1.12)
django PYPI version 3.1.12 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - directory-constants =21.0.1, =1.1.0rc0, =1.2.0 - rest-framework-djongo 0.1.7 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...
django-dragon (0.1.1), label-studio (>=1.3.0, <=1.4.0) potentially affected by CVE-2026-15830 via django (3.1.13)
django PYPI version 3.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-dragon 0.1.1 - label-studio =1.3.0, =1.4.0 Source cves: CVE-2026-15830 Source advisory: OSV:GHSA-Q238-5CXM-5C9H...
django-dragon (0.1.1), label-studio (>=1.3.0, <=1.4.0) potentially affected by CVE-2026-15830 via django (3.1.13)
django PYPI version 3.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-dragon 0.1.1 - label-studio =1.3.0, =1.4.0 Source cves: CVE-2026-15830 Source advisory: OSV:PYSEC-2026-3717...
CVE-2026-54690 vulnerabilities
Vulnerabilities for packages: label-studio...
CVE-2026-55389 vulnerabilities
Vulnerabilities for packages: label-studio...
CVE-2026-55391 vulnerabilities
Vulnerabilities for packages: label-studio...
CVE-2026-55403 vulnerabilities
Vulnerabilities for packages: label-studio...
GHSA-386Q-5HP3-95M9 vulnerabilities
Vulnerabilities for packages: label-studio...
GHSA-8359-H9FX-J6V9 vulnerabilities
Vulnerabilities for packages: label-studio...
GHSA-954P-556P-R752 vulnerabilities
Vulnerabilities for packages: label-studio...
GHSA-J884-Q54Q-MMX3 vulnerabilities
Vulnerabilities for packages: label-studio...
GHSA-R5VV-FF45-PRP2 vulnerabilities
Vulnerabilities for packages: label-studio...
GHSA-RFR2-MQ9M-X2QX vulnerabilities
Vulnerabilities for packages: label-studio...
CVE-2026-54621 vulnerabilities
Vulnerabilities for packages: label-studio...
CVE-2026-54653 vulnerabilities
Vulnerabilities for packages: label-studio...