Login Request a demo
CV
Product
cvat
by cvat-ai · last CVE Aug 20, 2026
22
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities22In the news0Timeline
Severity mix
Critical 2High 7Medium 13Low 0
Severity
All severities22Critical2High7Medium13Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add cvat to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-54573
6.5
0%
Jul 30
CVAT vulnerable to email verification bypass by use of basic authentication
Affected: >= 1.1.0, < 2.42.0
CVE-2025-49135
6.5
0%
Jun 25
CVAT missing validation for in-progress backup upload names
Affected: >= 2.2.0, < 2.40.0
CVE-2024-45393
6.4
0%
Sep 10
Computer Vision Annotation Tool (CVAT) is missing authorization for endpoints related to webhook deliveries
Affected: >= 2.3.0, < 2.18.0
CVE-2024-47064
6.1
0%
Sep 30
Computer Vision Annotation Tool (CVAT) contains a reflected XSS via request endpoints
Affected: >= 2.16.0, < 2.19.0
CVE-2024-47063
6.1
0%
Sep 30
Computer Vision Annotation Tool (CVAT) contains a stored XSS via the quality report data endpoint
Affected: >= 2.4.7, < 2.19.0
CVE-2026-23516
5.4
0%
Jan 21
CVAT vulnerable to XSS via skeleton SVG images
Affected: >= 2.2.0, < 2.55.0
CVE-2024-47172
5.4
0%
Sep 30
Computer Vision Annotation Tool (CVAT) access control is broken in several PATCH endpoints
Affected: >= 2.0.0, < 2.19.1
CVE-2026-73221
5.3
0%
Aug 11
CVAT: Flawed authorization logic in endpoints related to lambda requests
Affected: >= 2.17.0, < 2.72.0
CVE-2026-73219
5.3
0%
Aug 11
CVAT: Denial of service with regards to automatic annotation
Affected: >= 2.17.0, < 2.72.0
CVE-2025-64485
5.3
0%
Nov 7
CVAT: Mounted share file overwrite via crafted request
Affected: <= 2.4.0, < 2.49.0
CVE-2026-58373
4.3
0%
Jun 30
CVAT < 2.69.0 - Missing Authorization on Quality Reports parent_id Filter Leaks Cross-Organization Report Existence
Affected: before 2.69.0
CVE-2025-68430
4.3
0%
Dec 19
CVAT vulnerable to directory traversal via mounted share listing
Affected: >= 2.8.1, < 2.53.0
CVE-2025-48381
4.3
0%
May 30
CVAT has information disclosure via browsable API
Affected: >= 2.4.0, < 2.38.0
Showing 13