Label Studio - Sensitive Information Exposure

An attacker can construct a filter chain to filter tasks based on sensitive fields for all user accounts on the platform by exploiting Django's Object Relational Mapper ORM. Since the results of query can be manipulated by the ORM filter, an attacker can leak these sensitive fields character by...

Label Studio < 1.16.0 - Cross-Site Scripting

Label Studio prior to version 1.16.0 contains a cross-site scripting caused by rendering unsanitized user-provided HTML in the /projects/upload-example endpoint, letting attackers execute arbitrary JavaScript via crafted labelconfig in a GET request, exploit requires victims to visit malicious UR...

Label Studio - Cross-Site Scripting

Versions prior to 1.9.2 have a cross-site scripting XSS vulnerability that could be exploited when an authenticated user uploads a crafted image file for their avatar that gets rendered as a HTML file on the website. id: CVE-2023-47115 info: name: Label Studio - Cross-Site Scripting author: isaca...

CVE-2025-25296

CVE-2025-25296 Proof of Concept POC Description This project demonstrates a Proof of Concept POC for the CVE-2025-25296 vulnerability affecting Label Studio, an open-source data labeling tool. The vulnerability resides in the /projects/upload-example endpoint, which fails to sanitize user-provide...

CVE-2026-112395 vulnerabilities

Vulnerabilities for packages: open-webui, apache-beam-python-3.13-sdk, tensorflow-cpu-jupyter, py3-pillow, nemo-gym, kserve-xgbserver, jupyter-all-spark-notebook, openstack-horizon-2026.1, nemo-rl-cuda-13.0, pgadmin4, tensorflow-gpu-jupyter, netbox-fips, apache-beam-python-3.14-sdk, gftools,...

CVE-2026-112400 vulnerabilities

Vulnerabilities for packages: open-webui, apache-beam-python-3.13-sdk, tensorflow-cpu-jupyter, py3-pillow, nemo-gym, kserve-xgbserver, jupyter-all-spark-notebook, openstack-horizon-2026.1, nemo-rl-cuda-13.0, pgadmin4, tensorflow-gpu-jupyter, netbox-fips, apache-beam-python-3.14-sdk, gftools,...

CVE-2026-112404 vulnerabilities

Vulnerabilities for packages: open-webui, apache-beam-python-3.13-sdk, tensorflow-cpu-jupyter, py3-pillow, nemo-gym, kserve-xgbserver, jupyter-all-spark-notebook, openstack-horizon-2026.1, nemo-rl-cuda-13.0, pgadmin4, tensorflow-gpu-jupyter, netbox-fips, apache-beam-python-3.14-sdk, gftools,...

CVE-2026-112899 vulnerabilities

Vulnerabilities for packages: open-webui, apache-beam-python-3.13-sdk, tensorflow-cpu-jupyter, py3-pillow, nemo-gym, kserve-xgbserver, jupyter-all-spark-notebook, openstack-horizon-2026.1, nemo-rl-cuda-13.0, pgadmin4, tensorflow-gpu-jupyter, netbox-fips, apache-beam-python-3.14-sdk, gftools,...

CVE-2026-112895 vulnerabilities

Vulnerabilities for packages: open-webui, apache-beam-python-3.13-sdk, tensorflow-cpu-jupyter, py3-pillow, nemo-gym, kserve-xgbserver, jupyter-all-spark-notebook, openstack-horizon-2026.1, nemo-rl-cuda-13.0, pgadmin4, tensorflow-gpu-jupyter, netbox-fips, apache-beam-python-3.14-sdk, gftools,...

CVE-2026-112897 vulnerabilities

Vulnerabilities for packages: open-webui, apache-beam-python-3.13-sdk, tensorflow-cpu-jupyter, py3-pillow, nemo-gym, kserve-xgbserver, jupyter-all-spark-notebook, openstack-horizon-2026.1, nemo-rl-cuda-13.0, pgadmin4, tensorflow-gpu-jupyter, netbox-fips, apache-beam-python-3.14-sdk, gftools,...

CVE-2026-112397 vulnerabilities

Vulnerabilities for packages: open-webui, apache-beam-python-3.13-sdk, tensorflow-cpu-jupyter, py3-pillow, nemo-gym, kserve-xgbserver, jupyter-all-spark-notebook, openstack-horizon-2026.1, nemo-rl-cuda-13.0, pgadmin4, tensorflow-gpu-jupyter, netbox-fips, apache-beam-python-3.14-sdk, gftools,...

GHSA-VX6W-VV9F-6GVG vulnerabilities

Vulnerabilities for packages: open-webui, apache-beam-python-3.13-sdk, tensorflow-cpu-jupyter, py3-pillow, nemo-gym, kserve-xgbserver, jupyter-all-spark-notebook, openstack-horizon-2026.1, nemo-rl-cuda-13.0, pgadmin4, tensorflow-gpu-jupyter, netbox-fips, apache-beam-python-3.14-sdk, gftools,...

GHSA-Q45J-58J2-45RG vulnerabilities

Vulnerabilities for packages: open-webui, apache-beam-python-3.13-sdk, tensorflow-cpu-jupyter, py3-pillow, nemo-gym, kserve-xgbserver, jupyter-all-spark-notebook, openstack-horizon-2026.1, nemo-rl-cuda-13.0, pgadmin4, tensorflow-gpu-jupyter, netbox-fips, apache-beam-python-3.14-sdk, gftools,...

GHSA-PCHR-8J38-3X4P vulnerabilities

Vulnerabilities for packages: open-webui, apache-beam-python-3.13-sdk, tensorflow-cpu-jupyter, py3-pillow, nemo-gym, kserve-xgbserver, jupyter-all-spark-notebook, openstack-horizon-2026.1, nemo-rl-cuda-13.0, pgadmin4, tensorflow-gpu-jupyter, netbox-fips, apache-beam-python-3.14-sdk, gftools,...

GHSA-C6HW-5GRF-FF96 vulnerabilities

Vulnerabilities for packages: open-webui, apache-beam-python-3.13-sdk, tensorflow-cpu-jupyter, py3-pillow, nemo-gym, kserve-xgbserver, jupyter-all-spark-notebook, openstack-horizon-2026.1, nemo-rl-cuda-13.0, pgadmin4, tensorflow-gpu-jupyter, netbox-fips, apache-beam-python-3.14-sdk, gftools,...

GHSA-8G5G-8VMR-9782 vulnerabilities

Vulnerabilities for packages: open-webui, apache-beam-python-3.13-sdk, tensorflow-cpu-jupyter, py3-pillow, nemo-gym, kserve-xgbserver, jupyter-all-spark-notebook, openstack-horizon-2026.1, nemo-rl-cuda-13.0, pgadmin4, tensorflow-gpu-jupyter, netbox-fips, apache-beam-python-3.14-sdk, gftools,...

CVE-2026-112896 vulnerabilities

Vulnerabilities for packages: open-webui, apache-beam-python-3.13-sdk, tensorflow-cpu-jupyter, py3-pillow, nemo-gym, kserve-xgbserver, jupyter-all-spark-notebook, openstack-horizon-2026.1, nemo-rl-cuda-13.0, pgadmin4, tensorflow-gpu-jupyter, netbox-fips, apache-beam-python-3.14-sdk, gftools,...

GHSA-58R4-6RV3-GFH8 vulnerabilities

Vulnerabilities for packages: open-webui, apache-beam-python-3.13-sdk, tensorflow-cpu-jupyter, py3-pillow, nemo-gym, kserve-xgbserver, jupyter-all-spark-notebook, openstack-horizon-2026.1, nemo-rl-cuda-13.0, pgadmin4, tensorflow-gpu-jupyter, netbox-fips, apache-beam-python-3.14-sdk, gftools,...

CVE-2026-112403 vulnerabilities

Vulnerabilities for packages: open-webui, apache-beam-python-3.13-sdk, tensorflow-cpu-jupyter, py3-pillow, nemo-gym, kserve-xgbserver, jupyter-all-spark-notebook, openstack-horizon-2026.1, nemo-rl-cuda-13.0, pgadmin4, tensorflow-gpu-jupyter, netbox-fips, apache-beam-python-3.14-sdk, gftools,...

GHSA-P4WG-P73J-C528 vulnerabilities

Vulnerabilities for packages: open-webui, apache-beam-python-3.13-sdk, tensorflow-cpu-jupyter, py3-pillow, nemo-gym, kserve-xgbserver, jupyter-all-spark-notebook, openstack-horizon-2026.1, nemo-rl-cuda-13.0, pgadmin4, tensorflow-gpu-jupyter, netbox-fips, apache-beam-python-3.14-sdk, gftools,...