Product by Cvat-ai
Cvat
22 known vulnerabilities in Cvat (Cvat-ai), 0 of them actively exploited (CISA KEV).
Key figures
22
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2022-31188 | Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT) | 8.6 | |
| High | CVE-2026-73220 | CVAT: Stored XSS via annotation guides in audio tasks | — | |
| High | CVE-2026-65986 | CVAT has stored XSS via annotation guide assets | — | |
| Critical | CVE-2025-23045 | CVAT allows remote code execution via tracker Nuclio functions | 9.8 | |
| High | CVE-2026-47682 | CVAT: Missing path-containment validation in multiple entry points allows arbitrary path writes | — | |
| High | CVE-2026-44369 | CVAT: Stored XSS via annotation guides | — | |
| Medium | CVE-2026-73219 | CVAT: Denial of service with regards to automatic annotation | — | |
| High | CVE-2026-23526 | CVAT vulnerable to privilege escalation of users with staff status | 8.8 | |
| Medium | CVE-2026-73221 | CVAT: Flawed authorization logic in endpoints related to lambda requests | — | |
| High | CVE-2026-23516 | CVAT vulnerable to XSS via skeleton SVG images | 5.4 | |
| Medium | CVE-2026-58373 | Cvat: Missing Authorization | 4.3 | |
| High | CVE-2024-37164 | CVAT SSRF via custom cloud storage endpoints | 7.1 | |
| Medium | CVE-2025-64485 | CVAT: Mounted share file overwrite via crafted request | — | |
| Medium | CVE-2025-49135 | CVAT missing validation for in-progress backup upload names | 6.5 | |
| Medium | CVE-2025-68430 | CVAT vulnerable to directory traversal via mounted share listing | 4.3 | |
| Medium | CVE-2024-47064 | Computer Vision Annotation Tool (CVAT) contains a reflected XSS via request endpoints | 6.1 | |
| High | CVE-2024-37306 | CVAT's export and backup-related API endpoints are susceptible to CSRF | 7.1 | |
| Medium | CVE-2024-47063 | Computer Vision Annotation Tool (CVAT) contains a stored XSS via the quality report data endpoint | 6.1 | |
| Medium | CVE-2024-45393 | Cvat: Missing Authorization | 6.4 | |
| Medium | CVE-2025-48381 | CVAT has information disclosure via browsable API | 4.3 | |
| Medium | CVE-2024-47172 | Computer Vision Annotation Tool (CVAT) access control is broken in several PATCH endpoints | 5.4 | |
| Medium | CVE-2025-54573 | CVAT vulnerable to email verification bypass by use of basic authentication | 4.3 |