fiftyone
Refine high-quality datasets and visual AI models
View on Github
Activity
- Latest release
- 2d ago
- Total releases
- 189
- Cadence
- ~14 days
- Last 12 months
- 23
Reach
- Stars
- 11.1k
Details
- License
- Apache-2.0
- First release
- Dec 21, 2020
| Version | Released | |
|---|---|---|
1.22.0
minor
| ||
1.21.0
minor
| ||
1.20.1
patch
| ||
1.20.0
minor
| ||
1.19.0
minor
| ||
1.18.0
minor
| ||
1.17.0
minor
| ||
1.16.0
minor
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.15.0
minor
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.14.2
patch
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.14.1
patch
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.14.0
minor
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.13.5
patch
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.13.4
patch
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.13.3
patch
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.13.2
patch
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.13.1
patch
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.13.0
minor
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.12.0
minor
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.11.1
patch
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.11.0
minor
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.10.0
minor
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.9.0
minor
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.8.1
patch
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.8.0
minor
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.7.2
patch
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.7.1
patch
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.7.0
minor
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.6.0
minor
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.5.2
patch
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.5.1
patch
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.5.0
minor
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.4.1
patch
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.4.0
minor
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.3.2
patch
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.3.1
patch
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.3.0
minor
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.2.0
minor
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.1.0
minor
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.0.2
patch
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.0.1
patch
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
1.0.0
major
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
0.25.2
patch
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
0.25.1
patch
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
0.25.0
minor
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
0.24.1
patch
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
0.24.0
minor
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
0.23.8
patch
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
0.23.7
patch
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev | ||
0.23.6
patch
1 CVE
CVE-2026-53656
PYSEC-2026-3465
GHSA-q78p-hj9h-5466
Jul 23, 2026
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
6.3
/ 10
Medium
Local
Low
None
Required
Changed
High
None
None
ImpactThe FiftyOne App/API server ( Combined with the unauthenticated The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations. Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web. Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin. PatchesFixed in FiftyOne 1.17.0. The hard-coded Cross-origin access is now opt-in via a new The literal value Users should upgrade to FiftyOne 1.17.0 or later. WorkaroundsIn affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
Resources
Affected versions
0.1.0
0.1.0.1
0.1.2
0.1.3
0.10.0
0.11.0
0.11.1
0.11.2
0.11.2.1
0.12.0
0.13.0
0.13.1
+ 170 more Show less
0.13.2
0.13.3
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.0.1
0.15.0.2
0.15.1
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.18.0
0.18.0rc0
0.18.1rc0
0.18.1rc1
0.18.1rc10
0.18.1rc11
0.18.1rc12
0.18.1rc13
0.18.1rc14
0.18.1rc15
0.18.1rc16
0.18.1rc17
0.18.1rc18
0.18.1rc19
0.18.1rc2
0.18.1rc20
0.18.1rc21
0.18.1rc22
0.18.1rc23
0.18.1rc24
0.18.1rc25
0.18.1rc26
0.18.1rc3
0.18.1rc4
0.18.1rc5
0.18.1rc6
0.18.1rc7
0.18.1rc8
0.18.1rc9
0.19.0
0.19.1
0.19.1rc0
0.19.1rc1
0.2.0
0.2.0rc1
0.2.1
0.20.0
0.20.1
0.20.1rc1
0.20.1rc2
0.20.1rc3
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.22.1
0.22.2
0.22.3
0.23.0
0.23.0rc1
0.23.0rc2
0.23.1
0.23.2
0.23.3
0.23.3rc1
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.2.1
0.5.3
0.5.3.1
0.5.4
0.5.5
0.5.5.1
0.5.6
0.6.0
0.6.0.1
0.6.1
0.6.1.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.5.1
0.6.5.2
0.6.6
0.7.0
0.7.0.1
0.7.1
0.7.1.1
0.7.1.2
0.7.1.3
0.7.1.4
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.7.3.3
0.7.3.4
0.7.4
0.8.0
0.8.0.1
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
1.0.0
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
Fixed in
1.17.0
References
Updated Jul 23, 2026 · Source: OSV.dev |