CV
Product
cvat
22
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 7Medium 13Low 0
Watch
Add cvat to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-23526 | 8.8 | Jan 21 | CVAT vulnerable to privilege escalation of users with staff status Affected: >= 1.0.0, < 2.55.0 |
| CVE-2026-73220 | 8.5 | Aug 20 | CVAT: Stored XSS via annotation guides in audio tasks Affected: >= 2.68.0, < 2.70.0 |
| CVE-2026-65986 | 8.5 | Aug 4 | CVAT has stored XSS via annotation guide assets Affected: >= 2.5.0, < 2.67.0 |
| CVE-2026-44369 | 8.5 | May 13 | CVAT: Stored XSS via annotation guides Affected: >= 2.5.0, < 2.64.0 |
| CVE-2024-37164 | 8.5 | Jun 13 | CVAT SSRF via custom cloud storage endpoints Affected: >= 2.1.0, < 2.14.3 |
| CVE-2026-47682 | 7.1 | Aug 4 | CVAT: Missing path-containment validation in multiple entry points allows arbitrary path writes Affected: >= 1.6.0< 2.65.0 |
| CVE-2024-37306 | 7.1 | Jun 13 | CVAT's export and backup-related API endpoints are susceptible to CSRF Affected: >= 2.2.0, < 2.14.3 |
Showing 7