12317 matches found
CVE-2026-72560
A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRFPROTECTIONENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback addresses on the default installation. An...
EUVD-2026-56030
A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRFPROTECTIONENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback addresses on the default installation. An...
CVE-2026-72560 HumanSignal Label Studio - Server-Side Request Forgery
A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRFPROTECTIONENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback addresses on the default installation. An...
CVE-2026-72560 HumanSignal Label Studio - Server-Side Request Forgery
A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRFPROTECTIONENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback addresses on the default installation. An...
CVE-2026-72560
CVE-2026-72560 affects HumanSignal Label Studio (up to 1.24.0.dev0). The import-from-URL endpoint can fetch caller-supplied URLs, including internal loopback addresses, because SSRF_PROTECTION_ENABLED is false by default in the default installation. An authenticated user could use this to reach i...
CVE-2026-72560
A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRFPROTECTIONENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback addresses on the default installation. An...
PT-2026-70740
Name of the Vulnerable Software and Affected Versions Visual Studio Code affected versions not specified Description Incorrect authorization allows an unauthorized attacker to bypass a security feature locally. Recommendations At the moment, there is no information about a newer version that...
CVE-2026-58650: Authorization Bypass Through User-Controlled Key
Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...
CVE-2026-59113: Missing Authorization
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network...
PT-2026-70401
Name of the Vulnerable Software and Affected Versions Visual Studio Code affected versions not specified Description Missing authorization allows an unauthorized attacker to execute code over a network. Recommendations At the moment, there is no information about a newer version that contains a f...
PT-2026-70661
Name of the Vulnerable Software and Affected Versions Visual Studio Code CoPilot Chat Extension affected versions not specified Description An unauthorized attacker can bypass a security feature over a network within the Visual Studio Code CoPilot Chat Extension. Recommendations At the moment,...
CVE-2026-72560: Server-Side Request Forgery (SSRF)
A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRFPROTECTIONENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback addresses on the default installation. An...
CVE-2026-70335: Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an os command 'os command injection' in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally...
PT-2026-70390
Name of the Vulnerable Software and Affected Versions Visual Studio Code - Python extension affected versions not specified Description An issue exists where the inclusion of functionality from an untrusted control sphere allows an unauthorized attacker to bypass a security feature locally...
CVE-2026-54981: Inclusion of Functionality from Untrusted Control Sphere
Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature locally...
PT-2026-70370
Name of the Vulnerable Software and Affected Versions Visual Studio Code affected versions not specified Description Improper neutralization of special elements used in a command, known as command injection, allows an unauthorized attacker to disclose information over a network. Recommendations A...
PT-2026-70399
Name of the Vulnerable Software and Affected Versions Visual Studio Code affected versions not specified Description An authorization bypass exists that allows an unauthorized attacker to bypass a security feature locally through a user-controlled key. Recommendations At the moment, there is no...
PT-2026-70769
Name of the Vulnerable Software and Affected Versions Visual Studio Code affected versions not specified Description Improper control of code generation leads to a code injection flaw, which allows an unauthorized attacker to execute arbitrary code over a network. Recommendations At the moment,...
PT-2026-70135
Name of the Vulnerable Software and Affected Versions HumanSignal Label Studio versions prior to 1.24.0.dev0 Description An authenticated user can perform a server-side request forgery SSRF because the SSRF PROTECTION ENABLED variable is set to false by default. This allows the 'import-from-URL'...