CVE-2026-85211: Authorization Bypass Through User-Controlled Key

Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxyapi.py endpoints. Attackers can access other tenants' cloud storage objects by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents...

CVE-2026-85179: Server-Side Request Forgery (SSRF)

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...

CVE-2026-84967: Improper Neutralization of Special Elements used in an OS Command

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to...

PT-2026-85045

Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy api.py endpoints. Attackers can access other tenants' cloud storage objects by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents...

PT-2026-85038

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...

CVE-2026-62906: Improper Neutralization of Special Elements in Data Query Logic

Improper neutralization of special elements in data query logic in Microsoft Discovery Studio allows an unauthorized attacker to disclose information over a network...

CVE-2026-80098: Improper Verification of Cryptographic Signature

Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network...

PT-2026-85307

Name of the Vulnerable Software and Affected Versions Microsoft Discovery Studio affected versions not specified Description Improper neutralization of special elements in data query logic allows an unauthorized attacker to disclose protected information over a network. Recommendations At the...

PT-2026-85313

Name of the Vulnerable Software and Affected Versions Microsoft Copilot Studio affected versions not specified Description Improper verification of cryptographic signatures allows an unauthorized remote attacker to elevate privileges over a network. Recommendations At the moment, there is no...

PT-2026-85071

Name of the Vulnerable Software and Affected Versions MongoDB extension for Visual Studio Code affected versions not specified Description A component of the MongoDB extension for Visual Studio Code fails to neutralize special characters within a connection string before incorporating that value...

KLA91260 PE vulnerabilities in Microsoft Office

Privilege escalation vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to gain privileges. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Microsoft Fabric can be exploited remotely to gain privileges. 2. A...

CVE-2026-55421 Open edX Platform: SSRF in Studio Video Download Endpoint

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files.url, performs a server-side fetch using "requests.geturl, allowredirects=True". The fetched bytes are then returned inside a ZIP response. This...

CVE-2026-81890

creationtimestamp| type| source ---|---|--- 2026-09-02 16:35:38+00:00| published-proof-of-concept| https://github.com/Studio-42/elFinder/security/advisories/GHSA-9hjf-w35w-6vx2...

CVE-2026-81891

creationtimestamp| type| source ---|---|--- 2026-09-02 16:35:35+00:00| published-proof-of-concept| https://github.com/Studio-42/elFinder/security/advisories/GHSA-gxmj-r5rf-ggwq 2026-09-04 00:05:19+00:00| seen| https://bsky.app/profile/opsmatters.com/post/3muno52zkqz23 2026-09-08 03:44:17+00:00|...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload through the extract process. An attacker can execute arbitrary PHP code on the server by uploading a ZIP archive containing PHP-executable files and extracting them into a web-accessible directory. This is only...

Cross-site Request Forgery (CSRF)

Overview studio-42/elfinder is an open-source file manager for web, written in JavaScript using jQuery UI. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF in the netmount process. An attacker can force the application to mount an attacker-controlled FTP endpoin...

Server-side Request Forgery (SSRF)

Overview studio-42/elfinder is an open-source file manager for web, written in JavaScript using jQuery UI. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the fsockgetcontents process when PHP cURL is unavailable and URL uploads are used. An attacker can...

EUVD-2026-42695

Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation...

Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation

Summary The Studio API class definition creation endpoint in pimcore/studio-backend-bundle is guarded by the objects permission instead of the classes permission, allowing any standard editor-level user to create class definitions without admin privileges. Class definition creation is a structura...

GHSA-F97C-PH8J-8VFF Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation

Summary The Studio API class definition creation endpoint in pimcore/studio-backend-bundle is guarded by the objects permission instead of the classes permission, allowing any standard editor-level user to create class definitions without admin privileges. Class definition creation is a structura...