cvat-ai vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20246
3. 20256
4. 20269

Newest CVEs

• CVE-2026-73220

  CVAT: Stored XSS via annotation guides in audio tasks

  cvat-ai · cvat

  High8.5
• CVE-2026-73221

  CVAT: Flawed authorization logic in endpoints related to lambda requests

  cvat-ai · cvat

  Medium5.3
• CVE-2026-73219

  CVAT: Denial of service with regards to automatic annotation

  cvat-ai · cvat

  Medium5.3
• CVE-2026-65986

  CVAT has stored XSS via annotation guide assets

  cvat-ai · cvat

  High8.5
• CVE-2026-47682

  CVAT: Missing path-containment validation in multiple entry points allows arbitrary path writes

  cvat-ai · cvat

  High7.1
• CVE-2026-58373

  CVAT < 2.69.0 - Missing Authorization on Quality Reports parent_id Filter Leaks Cross-Organization Report Existence

  cvat-ai · cvat

  Medium5.3
• CVE-2026-44369

  CVAT: Stored XSS via annotation guides

  cvat-ai · cvat

  High8.5
• CVE-2026-23526

  CVAT vulnerable to privilege escalation of users with staff status

  cvat-ai · cvat

  High8.5
• CVE-2026-23516

  CVAT vulnerable to XSS via skeleton SVG images

  cvat-ai · cvat

  High8.6
• CVE-2025-68430

  CVAT vulnerable to directory traversal via mounted share listing

  cvat-ai · cvat

  Medium5.3