What’s Vulnerable › Products
Cvat Computer Vision Annotation Tool vulnerabilities
16 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.
Check whether your Cvat Computer Vision Annotation Tool version is affected
Exploited Cvat Computer Vision Annotation Tool vulnerabilities
- CVE-2021-45046 — Apache Log4j2 Deserialization of Untrusted Data Vulnerability
Latest Cvat Computer Vision Annotation Tool vulnerabilities
- CVE-2026-58373 — CVAT < 2.69.0 - Missing Authorization on Quality Reports parent_id Filter Leaks Cross-Organization Report Existence (CVSS 4.3)
- CVE-2026-23526 — CVAT vulnerable to privilege escalation of users with staff status (CVSS 8.8)
- CVE-2026-23516 — CVAT vulnerable to XSS via skeleton SVG images (CVSS 5.4)
- CVE-2025-68430 — CVAT vulnerable to directory traversal via mounted share listing (CVSS 4.3)
- CVE-2025-54573 — CVAT vulnerable to email verification bypass by use of basic authentication (CVSS 6.5)
- CVE-2025-49135 — CVAT missing validation for in-progress backup upload names (CVSS 6.5)
- CVE-2025-48381 — CVAT has information disclosure via browsable API (CVSS 4.3)
- CVE-2025-23045 — CVAT allows remote code execution via tracker Nuclio functions (CVSS 9.8)
- CVE-2024-47172 — Computer Vision Annotation Tool (CVAT) access control is broken in several PATCH endpoints (CVSS 5.4)
- CVE-2024-47064 — Computer Vision Annotation Tool (CVAT) contains a reflected XSS via request endpoints (CVSS 6.1)
- CVE-2024-47063 — Computer Vision Annotation Tool (CVAT) contains a stored XSS via the quality report data endpoint (CVSS 6.1)
- CVE-2024-45393 — Computer Vision Annotation Tool (CVAT) is missing authorization for endpoints related to webhook deliveries (CVSS 6.4)
- CVE-2024-37306 — CVAT's export and backup-related API endpoints are susceptible to CSRF (CVSS 7.1)
- CVE-2024-37164 — CVAT SSRF via custom cloud storage endpoints (CVSS 8.5)
- CVE-2022-31188 — Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT) (CVSS 9.8)
- CVE-2021-45046 — Apache Log4j2 Deserialization of Untrusted Data Vulnerability (CVSS 9.0) — exploited