Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint

DescriptionLabel Studio's S3 storage integration feature contains a Server-Side Request Forgery SSRF vulnerability in its endpoint configuration. When creating an S3 storage connection, the application allows users to specify a custom S3 endpoint URL via the s3endpoint parameter. This endpoint UR...

ethereumd-proxy (>=0.1.2, <=0.3.0), homeassistant (>=0.49.0, <=0.50.2) +7 more potentially affected by CVE-2024-52304 via aiohttp (2.2.3)

aiohttp PYPI version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - ethereumd-proxy =0.1.2, =0.49.0, =0.4.4, =0.1.1, =0.1.4, =0.1.0, =0.4.1b17, =0.6.0b3, =0.1.0b11, =0.1.0b19 Source cves: CVE-2024-52304 Source...

aioboto3 (>=1.1.0, <=2.1.0), aiobotocore (>=0.4.2, <=0.4.5) +2 more potentially affected by CVE-2024-52304 via aiohttp (2.3.0)

aiohttp PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioboto3 =1.1.0, =0.4.2, =0.4.1b31, =0.6.0b19, =0.6.0b23 Source cves: CVE-2024-52304 Source advisory: OSV:PYSEC-2026-1103...

django-leaflet-storage (0.8.0b0), django-mercadopago-simple (2.1.0) +1 more potentially affected by CVE-2024-45231 via django (1.8.5)

django PYPI version 1.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-leaflet-storage 0.8.0b0 - django-mercadopago-simple 2.1.0 - teamvault =0.5.0, =0.5.1 Source cves: CVE-2024-45231 Source advisory:...

modconf (0.4.0b2), tlseparation (1.1.3) +4 more potentially affected by CVE-2024-6345 via setuptools (36.0.1)

setuptools PYPI version 36.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - modconf 0.4.0b2 - tlseparation 1.1.3 - ws-sheets =0.5.0b1, =0.4.1b17, =0.1.0b11, =0.1.0b17 Source cves: CVE-2024-6345 Source advisory:...

ethereumd-proxy (>=0.1.2, <=0.3.0), homeassistant (>=0.49.0, <=0.50.2) +7 more potentially affected by CVE-2024-30251 via aiohttp (2.2.3)

aiohttp PYPI version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - ethereumd-proxy =0.1.2, =0.49.0, =0.4.4, =0.1.1, =0.1.4, =0.1.0, =0.4.1b17, =0.6.0b3, =0.1.0b11, =0.1.0b19 Source cves: CVE-2024-30251 Source...

aioboto3 (>=1.1.0, <=2.1.0), aiobotocore (>=0.4.2, <=0.4.5) +2 more potentially affected by CVE-2024-30251 via aiohttp (2.3.0)

aiohttp PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioboto3 =1.1.0, =0.4.2, =0.4.1b31, =0.6.0b19, =0.6.0b23 Source cves: CVE-2024-30251 Source advisory: OSV:PYSEC-2026-1098...

ethereumd-proxy (>=0.1.2, <=0.3.0), homeassistant (>=0.49.0, <=0.50.2) +7 more potentially affected by CVE-2024-27306 via aiohttp (2.2.3)

aiohttp PYPI version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - ethereumd-proxy =0.1.2, =0.49.0, =0.4.4, =0.1.1, =0.1.4, =0.1.0, =0.4.1b17, =0.6.0b3, =0.1.0b11, =0.1.0b19 Source cves: CVE-2024-27306 Source...

aioboto3 (>=1.1.0, <=2.1.0), aiobotocore (>=0.4.2, <=0.4.5) +2 more potentially affected by CVE-2024-27306 via aiohttp (2.3.0)

aiohttp PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioboto3 =1.1.0, =0.4.2, =0.4.1b31, =0.6.0b19, =0.6.0b23 Source cves: CVE-2024-27306 Source advisory: OSV:PYSEC-2026-1102...

django-leaflet-storage (0.8.0b0), heatmappy (>=0.2.0, <=0.2.6) +3 more potentially affected by CVE-2024-28219 via pillow (3.0.0)

pillow PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-leaflet-storage 0.8.0b0 - heatmappy =0.2.0, =0.1.4, =0.1.14 - swmmio 0.2.1 - wsy-captcha 1.0.0 Source cves: CVE-2024-28219 Source advisory:...

Allegro AI ClearML Stores Credentials in Plaintext in MongoDB Instance

Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords...

Ethyca Fides HTML Injection Vulnerability in HTML-Formatted DSR Packages

ImpactThe Fides web application allows data subject users to request access to their personal data. If the request is approved by the data controller user operating the Fides web application, the data subject's personal data can then retrieved from connected systems and data stores before being...

django-leaflet-storage (0.8.0b0), heatmappy (>=0.2.0, <=0.2.6) +3 more potentially affected by CVE-2023-4863 +1 more via pillow (3.0.0)

pillow PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-leaflet-storage 0.8.0b0 - heatmappy =0.2.0, =0.1.4, =0.1.14 - swmmio 0.2.1 - wsy-captcha 1.0.0 Source cves: CVE-2023-4863, CVE-2023-5129 Sour...

OpenStack Swift XML external entities (XXE) Injection

An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data...

PYSEC-2026-900 Plaintext storage of tokens in pulp_ansible

The collection remote for pulpansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API instead of marking it as write only...

CVE-2026-14867

Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all versions prior to 17.0.0. A local attacker could retrieve users’ credentials. Active Directory accounts are not affected by this vulnerability...

CVE-2026-14867 Insecure password storage in User directory

Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all versions prior to 17.0.0. A local attacker could retrieve users’ credentials. Active Directory accounts are not affected by this vulnerability...

CVE-2026-14867

PcVue projects store credentials for built-in users insecurely in the User directory, affecting all versions before 17.0.0. A local attacker could retrieve these credentials, impacting confidentiality. Active Directory accounts are not affected. The provided documents do not include explicit reme...

CVE-2026-14867 Insecure password storage in User directory

Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all versions prior to 17.0.0. A local attacker could retrieve users’ credentials. Active Directory accounts are not affected by this vulnerability...

CVE-2026-42147

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, S3 storage endpoint validation only checks URL format and testConnection sends a server-side request to the configured endpoint, allowing an authenticated user with storage...