Computer Vision Annotation Tool
Cvat · 16 CVEs
CVAT < 2.69.0 - Missing Authorization on Quality Reports parent_id Filter Leaks Cross-Organization Report Existence
Jun 30, 2026
CVAT vulnerable to privilege escalation of users with staff status
Jan 21, 2026
CVAT vulnerable to XSS via skeleton SVG images
Jan 21, 2026
CVAT vulnerable to directory traversal via mounted share listing
Dec 19, 2025
CVAT vulnerable to email verification bypass by use of basic authentication
Jul 30, 2025
CVAT missing validation for in-progress backup upload names
Jun 25, 2025
CVAT has information disclosure via browsable API
May 30, 2025
CVAT allows remote code execution via tracker Nuclio functions
Jan 28, 2025
Computer Vision Annotation Tool (CVAT) access control is broken in several PATCH endpoints
Sep 30, 2024
Computer Vision Annotation Tool (CVAT) contains a reflected XSS via request endpoints
Sep 30, 2024
Computer Vision Annotation Tool (CVAT) contains a stored XSS via the quality report data endpoint
Sep 30, 2024
Computer Vision Annotation Tool (CVAT) is missing authorization for endpoints related to webhook deliveries
Sep 10, 2024
CVAT's export and backup-related API endpoints are susceptible to CSRF
Jun 13, 2024
CVAT SSRF via custom cloud storage endpoints
Jun 13, 2024
Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT)
Aug 1, 2022
Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
Dec 14, 2021
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2026-58373 | CVAT < 2.69.0 - Missing Authorization on Quality Reports parent_id Filter Leaks Cross-Organization Report Existence | MEDIUM | 0.34% | Jun 30, 2026 |
| CVE-2026-23526 | CVAT vulnerable to privilege escalation of users with staff status | HIGH | 0.29% | Jan 21, 2026 |
| CVE-2026-23516 | CVAT vulnerable to XSS via skeleton SVG images | HIGH | 0.17% | Jan 21, 2026 |
| CVE-2025-68430 | CVAT vulnerable to directory traversal via mounted share listing | MEDIUM | 0.29% | Dec 19, 2025 |
| CVE-2025-54573 | CVAT vulnerable to email verification bypass by use of basic authentication | MEDIUM | 0.27% | Jul 30, 2025 |
| CVE-2025-49135 | CVAT missing validation for in-progress backup upload names | MEDIUM | 0.30% | Jun 25, 2025 |
| CVE-2025-48381 | CVAT has information disclosure via browsable API | MEDIUM | 0.29% | May 30, 2025 |
| CVE-2025-23045 | CVAT allows remote code execution via tracker Nuclio functions | HIGH | 0.50% | Jan 28, 2025 |
| CVE-2024-47172 | Computer Vision Annotation Tool (CVAT) access control is broken in several PATCH endpoints | MEDIUM | 0.26% | Sep 30, 2024 |
| CVE-2024-47064 | Computer Vision Annotation Tool (CVAT) contains a reflected XSS via request endpoints | MEDIUM | 0.31% | Sep 30, 2024 |
| CVE-2024-47063 | Computer Vision Annotation Tool (CVAT) contains a stored XSS via the quality report data endpoint | MEDIUM | 0.30% | Sep 30, 2024 |
| CVE-2024-45393 | Computer Vision Annotation Tool (CVAT) is missing authorization for endpoints related to webhook deliveries | MEDIUM | 0.24% | Sep 10, 2024 |
| CVE-2024-37306 | CVAT's export and backup-related API endpoints are susceptible to CSRF | HIGH | 0.21% | Jun 13, 2024 |
| CVE-2024-37164 | CVAT SSRF via custom cloud storage endpoints | HIGH | 0.35% | Jun 13, 2024 |
| CVE-2022-31188 | Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT) | CRITICAL | 48.64% | Aug 1, 2022 |
| CVE-2021-45046 KEV | Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack | CRITICAL | 99.98% | Dec 14, 2021 |
Showing 1 to 16 of 16 CVEs