Vulnerabilities

Filters

2 selected

16 records

Sort

Vendor: cvat-ai Component: Computer Vision Annotation Tool Clear all filters

TI-2026-42004 CVE-2026-58373 · GHSA-7fxw-w85g-2jg3

CVAT < 2.69.0 - Missing Authorization on Quality Reports parent_id Filter Leaks Cross-Organization Report Existence

LOW 24

CVAT before 2.69.0 contains an improper authorization vulnerability in QualityReportViewSet.get_queryset that allows authenticated attackers to enumerate quality report identifiers belonging to other organizations by exp…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00341 Published 2026-06-30 Fixed in 2.69.0 CWE-862

TI-2026-18950 CVE-2026-23526

CVAT vulnerable to privilege escalation of users with staff status

LOW 39

CVAT is an open source interactive video and image annotation tool for computer vision.

CVSS 4.0HIGH 8.5 Network High privileges No interaction EPSS 0.00296 Published 2026-01-21 Fixed in 2.55.0 CWE-267

TI-2026-18940 CVE-2026-23516

CVAT vulnerable to XSS via skeleton SVG images

LOW 38

CVAT is an open source interactive video and image annotation tool for computer vision.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.0017 Published 2026-01-21 Fixed in 2.55.0 CWE-83

TI-2025-41978 CVE-2025-68430

CVAT vulnerable to directory traversal via mounted share listing

LOW 24

CVAT is an open source interactive video and image annotation tool for computer vision.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00286 Published 2025-12-19 Fixed in 2.53.0 CWE-24

TI-2025-34350 CVE-2025-54573

CVAT vulnerable to email verification bypass by use of basic authentication

LOW 29

CVAT is an open source interactive video and image annotation tool for computer vision.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00302 Published 2025-07-30 Fixed in 2.42.0 CWE-287

TI-2025-31215 CVE-2025-49135

CVAT missing validation for in-progress backup upload names

LOW 24

CVAT is an open source interactive video and image annotation tool for computer vision.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00297 Published 2025-06-25 Fixed in 2.40.0 CWE-639

TI-2025-30706 CVE-2025-48381

CVAT has information disclosure via browsable API

LOW 30

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00298 Published 2025-05-30 Fixed in 2.38.0 CWE-201

TI-2025-16854 CVE-2025-23045

CVAT allows remote code execution via tracker Nuclio functions

MEDIUM 44

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00516 Published 2025-01-28 Fixed in 2.26.0 CWE-502

TI-2024-31540 CVE-2024-47172

Computer Vision Annotation Tool (CVAT) access control is broken in several PATCH endpoints

LOW 24

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00262 Published 2024-09-30 Fixed in 2.19.1 CWE-863

TI-2024-31446 CVE-2024-47064

Computer Vision Annotation Tool (CVAT) contains a reflected XSS via request endpoints

LOW 28

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision.

CVSS 4.0MEDIUM 6.3 Network No auth User interaction EPSS 0.00311 Published 2024-09-30 Fixed in 2.19.0 CWE-79

TI-2024-31445 CVE-2024-47063

Computer Vision Annotation Tool (CVAT) contains a stored XSS via the quality report data endpoint

LOW 29

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision.

CVSS 4.0MEDIUM 6.2 Network Low privileges User interaction EPSS 0.003 Published 2024-09-30 Fixed in 2.19.0 CWE-79

TI-2024-30442 CVE-2024-45393

Computer Vision Annotation Tool (CVAT) is missing authorization for endpoints related to webhook deliveries

LOW 28

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00242 Published 2024-09-10 Fixed in 2.18.0 CWE-862

TI-2024-24818 CVE-2024-37306

CVAT's export and backup-related API endpoints are susceptible to CSRF

LOW 31

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00206 Published 2024-06-13 Fixed in 2.14.3 CWE-352

TI-2024-24691 CVE-2024-37164

CVAT SSRF via custom cloud storage endpoints

LOW 37

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00347 Published 2024-06-13 Fixed in 2.14.3 CWE-918

TI-2022-13228 CVE-2022-31188

Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT)

HIGH 81

CVAT is an opensource interactive video and image annotation tool for computer vision.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.48223 Published 2022-08-01 Fixed in 2.0.0 CWE-918

TI-2021-20393 CVE-2021-45046 · GHSA-7rjr-3q55-vv33

Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

CRITICAL 98KEV

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations.

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.99977 Published 2021-12-14 Partial fix · 2.16.0, 2.12.2 +5 CWE-917