CV
Product
cvat
12
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 5Medium 6Low 0
Watch
Add cvat to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-31188 | 9.8 | Aug 1 | Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT) Affected: < 2.0.0 |
| CVE-2026-23526 | 8.8 | Jan 21 | CVAT vulnerable to privilege escalation of users with staff status Affected: >= 1.0.0, < 2.55.0 |
| CVE-2026-73220 | 8.5 | Aug 20 | CVAT: Stored XSS via annotation guides in audio tasks Affected: >= 2.68.0, < 2.70.0 |
| CVE-2026-65986 | 8.5 | Aug 4 | CVAT has stored XSS via annotation guide assets Affected: >= 2.5.0, < 2.67.0 |
| CVE-2026-44369 | 8.5 | May 13 | CVAT: Stored XSS via annotation guides Affected: >= 2.5.0, < 2.64.0 |
| CVE-2026-47682 | 7.1 | Aug 4 | CVAT: Missing path-containment validation in multiple entry points allows arbitrary path writes Affected: >= 1.6.0< 2.65.0 |
| CVE-2024-45393 | 6.4 | Sep 10 | Computer Vision Annotation Tool (CVAT) is missing authorization for endpoints related to webhook deliveries Affected: >= 2.3.0, < 2.18.0 |
| CVE-2026-23516 | 5.4 | Jan 21 | CVAT vulnerable to XSS via skeleton SVG images Affected: >= 2.2.0, < 2.55.0 |
| CVE-2026-73221 | 5.3 | Aug 11 | CVAT: Flawed authorization logic in endpoints related to lambda requests Affected: >= 2.17.0, < 2.72.0 |
| CVE-2026-73219 | 5.3 | Aug 11 | CVAT: Denial of service with regards to automatic annotation Affected: >= 2.17.0, < 2.72.0 |
| CVE-2026-58373 | 4.3 | Jun 30 | CVAT < 2.69.0 - Missing Authorization on Quality Reports parent_id Filter Leaks Cross-Organization Report Existence Affected: before 2.69.0 |
| CVE-2025-68430 | 4.3 | Dec 19 | CVAT vulnerable to directory traversal via mounted share listing Affected: >= 2.8.1, < 2.53.0 |
Showing 12