Vulnerabilities

TI-2026-51357 CVE-2026-73220

CVAT: Stored XSS via annotation guides in audio tasks

LOW 39

CVAT is an open source interactive video and image annotation tool for computer vision.

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.00483 Published 2026-08-20 Fixed in 2.70.0 CWE-80

TI-2026-51358 CVE-2026-73221

CVAT: Flawed authorization logic in endpoints related to lambda requests

LOW 24

CVAT is an open source interactive video and image annotation tool for computer vision.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00427 Published 2026-08-11 Fixed in 2.72.0 CWE-863

TI-2026-51356 CVE-2026-73219

CVAT: Denial of service with regards to automatic annotation

LOW 24

CVAT is an open source interactive video and image annotation tool for computer vision.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00466 Published 2026-08-11 Fixed in 2.72.0 CWE-1288

TI-2026-46997 CVE-2026-65986

CVAT has stored XSS via annotation guide assets

LOW 39

CVAT is an open source interactive video and image annotation tool for computer vision.

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.00405 Published 2026-08-04 Fixed in 2.67.0 CWE-434

TI-2026-35186 CVE-2026-47682

CVAT: Missing path-containment validation in multiple entry points allows arbitrary path writes

LOW 32

CVAT is an open source interactive video and image annotation tool for computer vision.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00454 Published 2026-08-04 No fix listed CWE-22

TI-2026-42004 CVE-2026-58373 · GHSA-7fxw-w85g-2jg3

CVAT < 2.69.0 - Missing Authorization on Quality Reports parent_id Filter Leaks Cross-Organization Report Existence

LOW 24

CVAT before 2.69.0 contains an improper authorization vulnerability in QualityReportViewSet.get_queryset that allows authenticated attackers to enumerate quality report identifiers belonging to other organizations by exp…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00341 Published 2026-06-30 Fixed in 2.69.0 CWE-862

TI-2026-32327 CVE-2026-44369

CVAT: Stored XSS via annotation guides

LOW 36

CVAT is an open source interactive video and image annotation tool for computer vision.

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.00266 Published 2026-05-13 Fixed in 2.64.0 CWE-80

TI-2026-18950 CVE-2026-23526

CVAT vulnerable to privilege escalation of users with staff status

LOW 39

CVAT is an open source interactive video and image annotation tool for computer vision.

CVSS 4.0HIGH 8.5 Network High privileges No interaction EPSS 0.00296 Published 2026-01-21 Fixed in 2.55.0 CWE-267

TI-2026-18940 CVE-2026-23516

CVAT vulnerable to XSS via skeleton SVG images

LOW 38

CVAT is an open source interactive video and image annotation tool for computer vision.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.0017 Published 2026-01-21 Fixed in 2.55.0 CWE-83

TI-2025-41978 CVE-2025-68430

CVAT vulnerable to directory traversal via mounted share listing

LOW 24

CVAT is an open source interactive video and image annotation tool for computer vision.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00286 Published 2025-12-19 Fixed in 2.53.0 CWE-24

TI-2025-39877 CVE-2025-64485

CVAT: Mounted share file overwrite via crafted request

LOW 24

CVAT is an open source interactive video and image annotation tool for computer vision.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00386 Published 2025-11-07 No fix listed CWE-22

TI-2025-34350 CVE-2025-54573

CVAT vulnerable to email verification bypass by use of basic authentication

LOW 29

CVAT is an open source interactive video and image annotation tool for computer vision.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00302 Published 2025-07-30 Fixed in 2.42.0 CWE-287

TI-2025-31215 CVE-2025-49135

CVAT missing validation for in-progress backup upload names

LOW 24

CVAT is an open source interactive video and image annotation tool for computer vision.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00297 Published 2025-06-25 Fixed in 2.40.0 CWE-639

TI-2025-30706 CVE-2025-48381

CVAT has information disclosure via browsable API

LOW 30

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00298 Published 2025-05-30 Fixed in 2.38.0 CWE-201

TI-2025-16854 CVE-2025-23045

CVAT allows remote code execution via tracker Nuclio functions

MEDIUM 44

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00516 Published 2025-01-28 Fixed in 2.26.0 CWE-502

TI-2024-31540 CVE-2024-47172

Computer Vision Annotation Tool (CVAT) access control is broken in several PATCH endpoints

LOW 24

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00262 Published 2024-09-30 Fixed in 2.19.1 CWE-863

TI-2024-31446 CVE-2024-47064

Computer Vision Annotation Tool (CVAT) contains a reflected XSS via request endpoints

LOW 28

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision.

CVSS 4.0MEDIUM 6.3 Network No auth User interaction EPSS 0.00311 Published 2024-09-30 Fixed in 2.19.0 CWE-79

TI-2024-31445 CVE-2024-47063

Computer Vision Annotation Tool (CVAT) contains a stored XSS via the quality report data endpoint

LOW 29

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision.

CVSS 4.0MEDIUM 6.2 Network Low privileges User interaction EPSS 0.003 Published 2024-09-30 Fixed in 2.19.0 CWE-79

TI-2024-30442 CVE-2024-45393

Computer Vision Annotation Tool (CVAT) is missing authorization for endpoints related to webhook deliveries

LOW 28

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00242 Published 2024-09-10 Fixed in 2.18.0 CWE-862

TI-2024-24818 CVE-2024-37306

CVAT's export and backup-related API endpoints are susceptible to CSRF

LOW 31

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00206 Published 2024-06-13 Fixed in 2.14.3 CWE-352

TI-2024-24691 CVE-2024-37164

CVAT SSRF via custom cloud storage endpoints

LOW 37

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00347 Published 2024-06-13 Fixed in 2.14.3 CWE-918

TI-2022-13228 CVE-2022-31188

Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT)

HIGH 81

CVAT is an opensource interactive video and image annotation tool for computer vision.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.48223 Published 2022-08-01 Fixed in 2.0.0 CWE-918

TI-2021-20393 CVE-2021-45046 · GHSA-7rjr-3q55-vv33

Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

CRITICAL 98KEV

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations.

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.99977 Published 2021-12-14 Partial fix · 2.16.0, 2.12.2 +5 CWE-917

Vulnerabilities

Filters