cvat-ai cvat

• CVE-2026-73220 High 8.5 CVAT: Stored XSS via annotation guides in audio tasks 0.5%
• CVE-2026-73221 Medium 5.3 CVAT: Flawed authorization logic in endpoints related to lambda requests 0.4%
• CVE-2026-73219 Medium 5.3 CVAT: Denial of service with regards to automatic annotation 0.5%
• CVE-2026-65986 High 8.5 CVAT has stored XSS via annotation guide assets 0.4%
• CVE-2026-47682 High 7.1 CVAT: Missing path-containment validation in multiple entry points allows arbitrary path writes 0.5%
• CVE-2026-58373 Medium 4.3 CVAT < 2.69.0 - Missing Authorization on Quality Reports parent_id Filter Leaks Cross-Organization Report Existence 0.3%
• CVE-2026-44369 High 8.5 CVAT: Stored XSS via annotation guides 0.3%
• CVE-2026-23526 High 8.5 CVAT vulnerable to privilege escalation of users with staff status 0.3%
• CVE-2026-23516 High 8.6 CVAT vulnerable to XSS via skeleton SVG images 0.2%
• CVE-2025-68430 Medium 5.3 CVAT vulnerable to directory traversal via mounted share listing 0.3%
• CVE-2025-64485 Medium 5.3 CVAT: Mounted share file overwrite via crafted request 0.4%
• CVE-2025-54573 Medium 4.3 CVAT vulnerable to email verification bypass by use of basic authentication 0.3%
• CVE-2025-49135 Medium 5.3 CVAT missing validation for in-progress backup upload names 0.3%
• CVE-2025-48381 Medium 5.3 CVAT has information disclosure via browsable API 0.3%
• CVE-2025-23045 High 8.7 CVAT allows remote code execution via tracker Nuclio functions 0.5%
• CVE-2024-47172 Medium 5.4 Computer Vision Annotation Tool (CVAT) access control is broken in several PATCH endpoints 0.3%
• CVE-2024-47064 Medium 6.3 Computer Vision Annotation Tool (CVAT) contains a reflected XSS via request endpoints 0.3%
• CVE-2024-47063 Medium 6.2 Computer Vision Annotation Tool (CVAT) contains a stored XSS via the quality report data endpoint 0.3%
• CVE-2024-45393 Medium 6.4 Computer Vision Annotation Tool (CVAT) is missing authorization for endpoints related to webhook deliveries 0.2%
• CVE-2024-37306 High 7.1 CVAT's export and backup-related API endpoints are susceptible to CSRF 0.2%
• CVE-2024-37164 High 7.1 CVAT SSRF via custom cloud storage endpoints 0.3%
• CVE-2022-31188 High 8.6 Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT) 48.2%