CVE-2026-75035 Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass

A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user'...

EUVD-2026-70489

Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxyapi.py endpoints. Attackers can access other tenants' cloud storage objects by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents...

CVE-2026-85211 Label Studio through 1.23.0 Cross-Organization Storage URI Resolution

Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxyapi.py endpoints. Attackers can access other tenants' cloud storage objects by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents...

CVE-2026-85211

Label Studio through 1.23.0 is affected by a cross-organization storage URI resolution flaw in proxy_api.py endpoints. The root cause is a failure to apply organization filters when resolving storage URIs for tasks and projects, allowing an attacker with low privileges to access other tenants' cl...

CVE-2026-85211 Label Studio through 1.23.0 Cross-Organization Storage URI Resolution

Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxyapi.py endpoints. Attackers can access other tenants' cloud storage objects by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents...

CVE-2026-85211 Label Studio through 1.23.0 Cross-Organization Storage URI Resolution

Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxyapi.py endpoints. Attackers can access other tenants' cloud storage objects by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents...

EUVD-2026-70483

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...

CVE-2026-85179 Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...

CVE-2026-85179 Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...

CVE-2026-85179

Label Studio versions through 1.23.0 are affected by a Server-Side Request Forgery (SSRF) vulnerability in the webhook functionality (specifically in webhooks/utils.py). The application fails to validate webhook URLs , allowing authenticated users to dispatch outbound requests to internal network...

CVE-2026-85179 Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

PT-2026-85038

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...

CVE-2026-85179: Server-Side Request Forgery (SSRF)

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...

PT-2026-85045

Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy api.py endpoints. Attackers can access other tenants' cloud storage objects by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents...

CVE-2026-85211: Authorization Bypass Through User-Controlled Key

Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxyapi.py endpoints. Attackers can access other tenants' cloud storage objects by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents...

CVE-2026-51728

creationtimestamp| type| source ---|---|--- 2026-09-02 16:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mukdoajga32w...

resolv: Resolv gem: DNS allowlist and egress bypass, and cache poisoning via crafted hostnames

A flaw was found in the resolv gem. This vulnerability arises from the incorrect handling of DNS label lengths during message encoding. A remote attacker could exploit this by providing a specially crafted hostname to an application utilizing the resolv gem. This could lead to the bypass of...

resolv: Resolv gem: DNS allowlist and egress bypass, and cache poisoning via crafted hostnames

A flaw was found in the resolv gem. This vulnerability arises from the incorrect handling of DNS label lengths during message encoding. A remote attacker could exploit this by providing a specially crafted hostname to an application utilizing the resolv gem. This could lead to the bypass of...

CVE-2025-15664

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser ...