CV
Product
cvat
22
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 7Medium 13Low 0
Watch
Add cvat to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-23045 | 9.8 | Jan 28 | CVAT allows remote code execution via tracker Nuclio functions Affected: >= 1.1.0, < 2.26.0 |
| CVE-2022-31188 | 9.8 | Aug 1 | Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT) Affected: < 2.0.0 |
| CVE-2026-23526 | 8.8 | Jan 21 | CVAT vulnerable to privilege escalation of users with staff status Affected: >= 1.0.0, < 2.55.0 |
| CVE-2026-73220 | 8.5 | Aug 20 | CVAT: Stored XSS via annotation guides in audio tasks Affected: >= 2.68.0, < 2.70.0 |
| CVE-2026-65986 | 8.5 | Aug 4 | CVAT has stored XSS via annotation guide assets Affected: >= 2.5.0, < 2.67.0 |
| CVE-2026-44369 | 8.5 | May 13 | CVAT: Stored XSS via annotation guides Affected: >= 2.5.0, < 2.64.0 |
| CVE-2024-37164 | 8.5 | Jun 13 | CVAT SSRF via custom cloud storage endpoints Affected: >= 2.1.0, < 2.14.3 |
| CVE-2026-47682 | 7.1 | Aug 4 | CVAT: Missing path-containment validation in multiple entry points allows arbitrary path writes Affected: >= 1.6.0< 2.65.0 |
| CVE-2024-37306 | 7.1 | Jun 13 | CVAT's export and backup-related API endpoints are susceptible to CSRF Affected: >= 2.2.0, < 2.14.3 |
| CVE-2025-54573 | 6.5 | Jul 30 | CVAT vulnerable to email verification bypass by use of basic authentication Affected: >= 1.1.0, < 2.42.0 |
| CVE-2025-49135 | 6.5 | Jun 25 | CVAT missing validation for in-progress backup upload names Affected: >= 2.2.0, < 2.40.0 |
| CVE-2024-45393 | 6.4 | Sep 10 | Computer Vision Annotation Tool (CVAT) is missing authorization for endpoints related to webhook deliveries Affected: >= 2.3.0, < 2.18.0 |
| CVE-2024-47064 | 6.1 | Sep 30 | Computer Vision Annotation Tool (CVAT) contains a reflected XSS via request endpoints Affected: >= 2.16.0, < 2.19.0 |
| CVE-2024-47063 | 6.1 | Sep 30 | Computer Vision Annotation Tool (CVAT) contains a stored XSS via the quality report data endpoint Affected: >= 2.4.7, < 2.19.0 |
| CVE-2026-23516 | 5.4 | Jan 21 | CVAT vulnerable to XSS via skeleton SVG images Affected: >= 2.2.0, < 2.55.0 |
| CVE-2024-47172 | 5.4 | Sep 30 | Computer Vision Annotation Tool (CVAT) access control is broken in several PATCH endpoints Affected: >= 2.0.0, < 2.19.1 |
| CVE-2026-73221 | 5.3 | Aug 11 | CVAT: Flawed authorization logic in endpoints related to lambda requests Affected: >= 2.17.0, < 2.72.0 |
| CVE-2026-73219 | 5.3 | Aug 11 | CVAT: Denial of service with regards to automatic annotation Affected: >= 2.17.0, < 2.72.0 |
| CVE-2025-64485 | 5.3 | Nov 7 | CVAT: Mounted share file overwrite via crafted request Affected: <= 2.4.0, < 2.49.0 |
| CVE-2026-58373 | 4.3 | Jun 30 | CVAT < 2.69.0 - Missing Authorization on Quality Reports parent_id Filter Leaks Cross-Organization Report Existence Affected: before 2.69.0 |
| CVE-2025-68430 | 4.3 | Dec 19 | CVAT vulnerable to directory traversal via mounted share listing Affected: >= 2.8.1, < 2.53.0 |
| CVE-2025-48381 | 4.3 | May 30 | CVAT has information disclosure via browsable API Affected: >= 2.4.0, < 2.38.0 |
Showing 22