CVE Tools
Track your stack

Cvat

4 CVEs tracked since 2024. Since Sep 2024, none of them reached CISA KEV.

Cvat CVEs per month

Sep 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Cvat CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2024-0940
2024-104 or fewer
2024-114 or fewer
2024-123 or fewer
2025-014 or fewer
2025-023 or fewer
2025-035 or fewer
2025-044 or fewer
2025-054 or fewer
2025-064 or fewer
2025-075 or fewer
2025-084 or fewer
2025-094 or fewer
2025-104 or fewer
2025-114 or fewer
2025-125 or fewer
2026-015 or fewer
2026-025 or fewer
2026-037 or fewer
2026-046 or fewer
2026-057 or fewer
2026-067 or fewer
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-1011 or fewer
2026-113 or fewer

Products

The products that kept showing up in Cvat's monthly top three, with their CVEs summed over those months.

  1. Computer Vision Annotation Tool41 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Cvat.

  1. CVE-2026-58373CVAT < 2.69.0 - Missing Authorization on Quality Reports parent_id Filter Leaks Cross-Organization Report Existence4.3
  2. CVE-2026-23526CVAT vulnerable to privilege escalation of users with staff status8.8
  3. CVE-2026-23516CVAT vulnerable to XSS via skeleton SVG images5.4
  4. CVE-2025-68430CVAT vulnerable to directory traversal via mounted share listing4.3
  5. CVE-2025-54573CVAT vulnerable to email verification bypass by use of basic authentication4.3
  6. CVE-2025-49135CVAT missing validation for in-progress backup upload names6.5
  7. CVE-2025-48381CVAT has information disclosure via browsable API4.3
  8. CVE-2025-23045CVAT allows remote code execution via tracker Nuclio functions9.8
  9. CVE-2024-47172Computer Vision Annotation Tool (CVAT) access control is broken in several PATCH endpoints5.4
  10. CVE-2024-47064Computer Vision Annotation Tool (CVAT) contains a reflected XSS via request endpoints6.1
  11. CVE-2024-47063Computer Vision Annotation Tool (CVAT) contains a stored XSS via the quality report data endpoint6.1
  12. CVE-2024-45393Computer Vision Annotation Tool (CVAT) is missing authorization for endpoints related to webhook deliveries6.4
  13. CVE-2024-37306CVAT's export and backup-related API endpoints are susceptible to CSRF7.1
  14. CVE-2024-37164CVAT SSRF via custom cloud storage endpoints7.1
  15. CVE-2022-31188Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT)8.6

The record

Peak rank
#152 in Sep 2024
Busiest month shown
Sep 2024, 4 CVEs
Months with a KEV entry
0 since Sep 2024
Monthly snapshots
1 since 2024
Cvat's full record, month by month