CV
Vendor
Cvat
17
CVEs
1
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-58373 | CV Computer Vision Annotation Tool Cvat | 4.3 | Jun 30 | CVAT < 2.69.0 - Missing Authorization on Quality Reports parent_id Filter Leaks Cross-Organization Report Existence |
| CVE-2026-23526 | CV Computer Vision Annotation Tool Cvat | 8.8 | Jan 21 | CVAT vulnerable to privilege escalation of users with staff status |
| CVE-2026-23516 | CV Computer Vision Annotation Tool Cvat | 5.4 | Jan 21 | CVAT vulnerable to XSS via skeleton SVG images |
| CVE-2025-68430 | CV Computer Vision Annotation Tool Cvat | 4.3 | Dec 19 | CVAT vulnerable to directory traversal via mounted share listing |
| CVE-2025-54573 | CV Computer Vision Annotation Tool Cvat | 6.5 | Jul 30 | CVAT vulnerable to email verification bypass by use of basic authentication |
| CVE-2025-49135 | CV Computer Vision Annotation Tool Cvat | 6.5 | Jun 25 | CVAT missing validation for in-progress backup upload names |
| CVE-2025-48381 | CV Computer Vision Annotation Tool Cvat | 4.3 | May 30 | CVAT has information disclosure via browsable API |
| CVE-2025-23045 | CV Computer Vision Annotation Tool Cvat | 9.8 | Jan 28 | CVAT allows remote code execution via tracker Nuclio functions |
| CVE-2024-47172 | CV Computer Vision Annotation Tool Cvat | 5.4 | Sep 30 | Computer Vision Annotation Tool (CVAT) access control is broken in several PATCH endpoints |
| CVE-2024-47064 | CV Computer Vision Annotation Tool Cvat | 6.1 | Sep 30 | Computer Vision Annotation Tool (CVAT) contains a reflected XSS via request endpoints |
| CVE-2024-47063 | CV Computer Vision Annotation Tool Cvat | 6.1 | Sep 30 | Computer Vision Annotation Tool (CVAT) contains a stored XSS via the quality report data endpoint |
| CVE-2024-45393 | CV Computer Vision Annotation Tool Cvat | 6.4 | Sep 10 | Computer Vision Annotation Tool (CVAT) is missing authorization for endpoints related to webhook deliveries |
| CVE-2024-37306 | CV Computer Vision Annotation Tool Cvat | 7.1 | Jun 13 | CVAT's export and backup-related API endpoints are susceptible to CSRF |
| CVE-2024-37164 | CV Computer Vision Annotation Tool Cvat | 8.5 | Jun 13 | CVAT SSRF via custom cloud storage endpoints |
| CVE-2022-31188 | CV Computer Vision Annotation Tool Cvat | 9.8 | Aug 1 | Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT) |
| CVE-2021-45046 RansomwareIn wildKEV | CV Computer Vision Annotation Tool Cvat | 9.0 | Dec 14 | Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack |