High
CVE-2026-22033
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 14
Reset filters
Medium
CVE-2025-5173
HumanSignal label-studio-ml-backend Deserialization of Untrusted Data vulnerability
Medium
CVE-2025-25296
Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint
High
CVE-2025-25297
Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint
High
CVE-2025-25295
Label Studio has a Path Traversal Vulnerability via image Field
High
CVE-2025-47783
label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter.
Medium
CVE-2024-26152
Summary
Medium
CVE-2023-47116
Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections
Medium
CVE-2024-23633
Cross-site Scripting Vulnerability on Data Import
High
CVE-2023-47115
Cross-site Scripting Vulnerability on Avatar Upload
High
CVE-2023-47117
Label Studio Object Relational Mapper Leak Vulnerability in Filtering Task
Critical
CVE-2023-43791
Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens
High
ghsa-cpmr-mw4j-99r7
Nginx alias path traversal allows unauthenticated attackers to read all files on /label_studio/core/
High
CVE-2022-36551
A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the syst
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.