CV
Vendor
cvat-ai
22
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-73220 | CV cvat cvat-ai | 8.5 | Aug 20 | CVAT: Stored XSS via annotation guides in audio tasks |
| CVE-2026-73221 | CV cvat cvat-ai | 5.3 | Aug 11 | CVAT: Flawed authorization logic in endpoints related to lambda requests |
| CVE-2026-73219 | CV cvat cvat-ai | 5.3 | Aug 11 | CVAT: Denial of service with regards to automatic annotation |
| CVE-2026-65986 | CV cvat cvat-ai | 8.5 | Aug 4 | CVAT has stored XSS via annotation guide assets |
| CVE-2026-47682 | CV cvat cvat-ai | 7.1 | Aug 4 | CVAT: Missing path-containment validation in multiple entry points allows arbitrary path writes |
| CVE-2026-58373 | CV cvat cvat-ai | 4.3 | Jun 30 | CVAT < 2.69.0 - Missing Authorization on Quality Reports parent_id Filter Leaks Cross-Organization Report Existence |
| CVE-2026-44369 | CV cvat cvat-ai | 8.5 | May 13 | CVAT: Stored XSS via annotation guides |
| CVE-2026-23526 | CV cvat cvat-ai | 8.8 | Jan 21 | CVAT vulnerable to privilege escalation of users with staff status |
| CVE-2026-23516 | CV cvat cvat-ai | 5.4 | Jan 21 | CVAT vulnerable to XSS via skeleton SVG images |
| CVE-2025-68430 | CV cvat cvat-ai | 4.3 | Dec 19 | CVAT vulnerable to directory traversal via mounted share listing |
| CVE-2025-64485 | CV cvat cvat-ai | 5.3 | Nov 7 | CVAT: Mounted share file overwrite via crafted request |
| CVE-2025-54573 | CV cvat cvat-ai | 6.5 | Jul 30 | CVAT vulnerable to email verification bypass by use of basic authentication |
| CVE-2025-49135 | CV cvat cvat-ai | 6.5 | Jun 25 | CVAT missing validation for in-progress backup upload names |
| CVE-2025-48381 | CV cvat cvat-ai | 4.3 | May 30 | CVAT has information disclosure via browsable API |
| CVE-2025-23045 | CV cvat cvat-ai | 9.8 | Jan 28 | CVAT allows remote code execution via tracker Nuclio functions |
| CVE-2024-47172 | CV cvat cvat-ai | 5.4 | Sep 30 | Computer Vision Annotation Tool (CVAT) access control is broken in several PATCH endpoints |
| CVE-2024-47064 | CV cvat cvat-ai | 6.1 | Sep 30 | Computer Vision Annotation Tool (CVAT) contains a reflected XSS via request endpoints |
| CVE-2024-47063 | CV cvat cvat-ai | 6.1 | Sep 30 | Computer Vision Annotation Tool (CVAT) contains a stored XSS via the quality report data endpoint |
| CVE-2024-45393 | CV cvat cvat-ai | 6.4 | Sep 10 | Computer Vision Annotation Tool (CVAT) is missing authorization for endpoints related to webhook deliveries |
| CVE-2024-37306 | CV cvat cvat-ai | 7.1 | Jun 13 | CVAT's export and backup-related API endpoints are susceptible to CSRF |
| CVE-2024-37164 | CV cvat cvat-ai | 8.5 | Jun 13 | CVAT SSRF via custom cloud storage endpoints |
| CVE-2022-31188 | CV cvat cvat-ai | 9.8 | Aug 1 | Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT) |