{"schema_version":1,"title":"HumanSignal vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 8 vulnerabilities in HumanSignal: 0 in the last 7 days and 4 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-121561, was published on 3 November 2026. 1 vulnerability in the last four weeks, up from none in the four before.","url":"https://junglewise.ai/threats/vendors/humansignal","json_url":"https://junglewise.ai/threats/vendors/humansignal.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/humansignal","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","thin":true,"counts":{"high":6,"all_time":8,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":1,"last_90_days":4,"last_365_days":6},"latest":[{"cve":"CVE-2026-121561","cvss":7.7,"slug":"cve-2026-121561-label-studio-before-1-23-2-label-studio-sdk-before-2-1-2","title":"Label Studio server-side request forgery in export formats","severity":"high","exploited":false,"published_at":"2026-11-03T16:17:28.94+00:00","url":"https://junglewise.ai/threats/cve-2026-121561-label-studio-before-1-23-2-label-studio-sdk-before-2-1-2"},{"cve":"CVE-2026-85211","cvss":7.7,"epss":0.0042,"slug":"cve-2026-85211-label-studio-organization-filter-bypass-in-proxy-api-py","title":"Label Studio organization filter bypass in proxy_api.py","severity":"high","exploited":false,"published_at":"2026-09-03T15:17:40.257+00:00","url":"https://junglewise.ai/threats/cve-2026-85211-label-studio-organization-filter-bypass-in-proxy-api-py"},{"cve":"CVE-2026-85179","cvss":8.5,"epss":0.004,"slug":"cve-2026-85179-label-studio-webhook-url-validation-bypass","title":"Label Studio webhook URL validation bypass","severity":"high","exploited":false,"published_at":"2026-09-03T15:17:39.097+00:00","url":"https://junglewise.ai/threats/cve-2026-85179-label-studio-webhook-url-validation-bypass"},{"cve":"CVE-2026-76073","cvss":8.8,"epss":0.0052,"slug":"cve-2026-76073-label-studio-annotation-api-missing-organization-scope-check","title":"Label Studio annotation API missing organization scope check","severity":"high","exploited":false,"published_at":"2026-08-24T18:17:21.41+00:00","url":"https://junglewise.ai/threats/cve-2026-76073-label-studio-annotation-api-missing-organization-scope-check"},{"cve":"CVE-2026-72560","cvss":6.5,"epss":0.0034,"slug":"cve-2026-72560-humansignal-label-studio-server-side-request-forgery-in-url","title":"HumanSignal Label Studio server-side request forgery in URL import","severity":"medium","exploited":false,"published_at":"2026-08-11T12:17:41.953+00:00","url":"https://junglewise.ai/threats/cve-2026-72560-humansignal-label-studio-server-side-request-forgery-in-url"},{"cve":"CVE-2026-22033","cvss":4,"epss":0.0028,"slug":"cve-2026-22033-label-studio-stored-xss-in-custom-hotkeys-with-account-takeover","title":"Label Studio stored XSS in custom_hotkeys with account takeover","severity":"medium","exploited":false,"published_at":"2026-07-07T16:03:18.065167+00:00","url":"https://junglewise.ai/threats/cve-2026-22033-label-studio-stored-xss-in-custom-hotkeys-with-account-takeover"},{"cve":"CVE-2025-47783","cvss":4,"epss":0.0059,"slug":"cve-2025-47783-humansignal-label-studio-reflected-xss-in-label-config-parameter","title":"HumanSignal Label Studio reflected XSS in label_config parameter","severity":"high","exploited":false,"published_at":"2025-05-15T16:21:16+00:00","url":"https://junglewise.ai/threats/cve-2025-47783-humansignal-label-studio-reflected-xss-in-label-config-parameter"},{"cvss":7.5,"slug":"label-studio-nginx-path-traversal-allows-unauthorized-file-access-08f7d110","title":"Label Studio Nginx path traversal allows unauthorized file access","severity":"high","exploited":false,"published_at":"2023-03-24T22:04:02+00:00","url":"https://junglewise.ai/threats/label-studio-nginx-path-traversal-allows-unauthorized-file-access-08f7d110"}],"vendor":{"hub":true,"name":"HumanSignal","slug":"humansignal","description":"Provider of Label Studio, an open-source data labeling platform.","url":"https://junglewise.ai/threats/vendors/humansignal"},"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-76073","cvss":8.8,"epss":0.0052,"slug":"cve-2026-76073-label-studio-annotation-api-missing-organization-scope-check","title":"Label Studio annotation API missing organization scope check","severity":"high","exploited":false,"published_at":"2026-08-24T18:17:21.41+00:00","url":"https://junglewise.ai/threats/cve-2026-76073-label-studio-annotation-api-missing-organization-scope-check"},{"cve":"CVE-2026-85179","cvss":8.5,"epss":0.004,"slug":"cve-2026-85179-label-studio-webhook-url-validation-bypass","title":"Label Studio webhook URL validation bypass","severity":"high","exploited":false,"published_at":"2026-09-03T15:17:39.097+00:00","url":"https://junglewise.ai/threats/cve-2026-85179-label-studio-webhook-url-validation-bypass"},{"cve":"CVE-2026-85211","cvss":7.7,"epss":0.0042,"slug":"cve-2026-85211-label-studio-organization-filter-bypass-in-proxy-api-py","title":"Label Studio organization filter bypass in proxy_api.py","severity":"high","exploited":false,"published_at":"2026-09-03T15:17:40.257+00:00","url":"https://junglewise.ai/threats/cve-2026-85211-label-studio-organization-filter-bypass-in-proxy-api-py"},{"cve":"CVE-2026-121561","cvss":7.7,"slug":"cve-2026-121561-label-studio-before-1-23-2-label-studio-sdk-before-2-1-2","title":"Label Studio server-side request forgery in export formats","severity":"high","exploited":false,"published_at":"2026-11-03T16:17:28.94+00:00","url":"https://junglewise.ai/threats/cve-2026-121561-label-studio-before-1-23-2-label-studio-sdk-before-2-1-2"},{"cvss":7.5,"slug":"label-studio-nginx-path-traversal-allows-unauthorized-file-access-08f7d110","title":"Label Studio Nginx path traversal allows unauthorized file access","severity":"high","exploited":false,"published_at":"2023-03-24T22:04:02+00:00","url":"https://junglewise.ai/threats/label-studio-nginx-path-traversal-allows-unauthorized-file-access-08f7d110"},{"cve":"CVE-2025-47783","cvss":4,"epss":0.0059,"slug":"cve-2025-47783-humansignal-label-studio-reflected-xss-in-label-config-parameter","title":"HumanSignal Label Studio reflected XSS in label_config parameter","severity":"high","exploited":false,"published_at":"2025-05-15T16:21:16+00:00","url":"https://junglewise.ai/threats/cve-2025-47783-humansignal-label-studio-reflected-xss-in-label-config-parameter"},{"cve":"CVE-2026-72560","cvss":6.5,"epss":0.0034,"slug":"cve-2026-72560-humansignal-label-studio-server-side-request-forgery-in-url","title":"HumanSignal Label Studio server-side request forgery in URL import","severity":"medium","exploited":false,"published_at":"2026-08-11T12:17:41.953+00:00","url":"https://junglewise.ai/threats/cve-2026-72560-humansignal-label-studio-server-side-request-forgery-in-url"},{"cve":"CVE-2026-22033","cvss":4,"epss":0.0028,"slug":"cve-2026-22033-label-studio-stored-xss-in-custom-hotkeys-with-account-takeover","title":"Label Studio stored XSS in custom_hotkeys with account takeover","severity":"medium","exploited":false,"published_at":"2026-07-07T16:03:18.065167+00:00","url":"https://junglewise.ai/threats/cve-2026-22033-label-studio-stored-xss-in-custom-hotkeys-with-account-takeover"}],"generated_at":"2026-11-11T03:07:00.183524+00:00","technologies":[]}