Product by Cvat

    Computer Vision Annotation Tool (CVAT)

    16 known vulnerabilities in Computer Vision Annotation Tool (CVAT) (Cvat), 1 of them actively exploited (CISA KEV).

    Key figures

    16

    Vulnerabilities

    1

    Actively exploited (KEV)

    1

    Used by ransomware

    3

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Computer Vision Annotation Tool (CVAT) (Cvat)
    CriticalCVE-2021-45046

    Apache Log4j2 Deserialization of Untrusted Data Vulnerability

    In CISA KEVRansomwarealso in 22 other products

    		9.0
    CriticalCVE-2022-31188

    Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT)

    also in 1 other product

    		8.6
    CriticalCVE-2025-23045

    CVAT allows remote code execution via tracker Nuclio functions

    also in 1 other product

    		9.8
    HighCVE-2026-23526

    CVAT vulnerable to privilege escalation of users with staff status

    also in 1 other product

    		8.8
    HighCVE-2026-23516

    CVAT vulnerable to XSS via skeleton SVG images

    also in 1 other product

    		5.4
    MediumCVE-2026-58373

    Cvat: Missing Authorization

    also in 1 other product

    		4.3
    HighCVE-2024-37164

    CVAT SSRF via custom cloud storage endpoints

    also in 1 other product

    		7.1
    MediumCVE-2025-49135

    CVAT missing validation for in-progress backup upload names

    also in 1 other product

    		6.5
    MediumCVE-2025-68430

    CVAT vulnerable to directory traversal via mounted share listing

    also in 1 other product

    		4.3
    MediumCVE-2024-47064

    Computer Vision Annotation Tool (CVAT) contains a reflected XSS via request endpoints

    also in 1 other product

    		6.1
    HighCVE-2024-37306

    CVAT's export and backup-related API endpoints are susceptible to CSRF

    also in 1 other product

    		7.1
    MediumCVE-2024-47063

    Computer Vision Annotation Tool (CVAT) contains a stored XSS via the quality report data endpoint

    also in 1 other product

    		6.1
    MediumCVE-2024-45393

    Cvat: Missing Authorization

    also in 1 other product

    		6.4
    MediumCVE-2025-48381

    CVAT has information disclosure via browsable API

    also in 1 other product

    		4.3
    MediumCVE-2024-47172

    Computer Vision Annotation Tool (CVAT) access control is broken in several PATCH endpoints

    also in 1 other product

    		5.4
    MediumCVE-2025-54573

    CVAT vulnerable to email verification bypass by use of basic authentication

    also in 1 other product

    		4.3

    News

    All products by Cvat