Advisories · Technology

HumanSignal label-studio.

Every CVE that names HumanSignal label-studio among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-121561 CVE record

CVSS 6.3 Medium

Label Studio before 1.23.2 SSRF and Token Disclosure via Image Export Downloads
- HumanSignal label-studio
- HumanSignal label-studio-sdk
- Server-side request forgery (SSRF)
Not analysed yet 3 Nov 2026
CVE-2026-85211 CVE record

CVSS 8.3 High

Label Studio through 1.23.0 Cross-Organization Storage URI Resolution
- HumanSignal label-studio
- Broken access control
Not analysed yet 3 Sept 2026
CVE-2026-85179 CVE record

CVSS 8.4 High

Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL
- HumanSignal label-studio
- Server-side request forgery (SSRF)
Not analysed yet 3 Sept 2026
CVE-2026-76073 CVE record

CVSS 8.7 High

Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset
- HumanSignal label-studio
- Broken access control
Not analysed yet 24 Aug 2026
CVE-2026-72560 CVE record

CVSS 6.5 Medium

HumanSignal Label Studio - Server-Side Request Forgery
- HumanSignal Label Studio
- Server-side request forgery (SSRF)
Not analysed yet 11 Aug 2026