Skip to content
Noroxi

cvat records

16 published records for vendor cvat.

Researcher profile

Entered KEV
1 · 6.3%
Weaponized
1 · 6.3%
Pre-auth RCE
2
With a fix record
18.8%
Median publish → KEV
503 days

Records by year

  1. 21
  2. 22
  3. 24
  4. 25
  5. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

16 records
  • CVE-2021-45046
    96Now

    Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

    CriticalCVSS 9.0KEVWeaponizedEPSS 99%

    apache · log4jDec 14, 2021

  • CVE-2022-31188
    53Plan

    Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT)

    CriticalCVSS 9.8Proof of conceptEPSS 48%

    cvat · computer vision annotation toolAug 1, 2022

  • CVE-2025-23045
    34Monitor

    CVAT allows remote code execution via tracker Nuclio functions

    HighCVSS 8.7No exploitEPSS 0%

    cvat · computer vision annotation toolJan 28, 2025

  • CVE-2024-37164
    34Monitor

    CVAT SSRF via custom cloud storage endpoints

    HighCVSS 8.5No exploitEPSS 0%

    cvat · computer vision annotation toolJun 13, 2024

  • CVE-2026-23526
    34Monitor

    CVAT vulnerable to privilege escalation of users with staff status

    HighCVSS 8.5No exploitEPSS 0%

    cvat · computer vision annotation toolJan 21, 2026

  • CVE-2026-23516
    34Monitor

    CVAT vulnerable to XSS via skeleton SVG images

    HighCVSS 8.6No exploitEPSS 0%

    cvat · computer vision annotation toolJan 21, 2026

  • CVE-2024-37306
    28Monitor

    CVAT's export and backup-related API endpoints are susceptible to CSRF

    HighCVSS 7.1No exploitEPSS 0%

    cvat · computer vision annotation toolJun 13, 2024

  • CVE-2025-54573
    26Monitor

    CVAT vulnerable to email verification bypass by use of basic authentication

    MediumCVSS 6.5No exploitEPSS 0%

    cvat · computer vision annotation toolJul 30, 2025

  • CVE-2024-47064
    25Monitor

    Computer Vision Annotation Tool (CVAT) contains a reflected XSS via request endpoints

    MediumCVSS 6.3No exploitEPSS 0%

    cvat · computer vision annotation toolSep 30, 2024

  • CVE-2024-45393
    25Monitor

    Computer Vision Annotation Tool (CVAT) is missing authorization for endpoints related to webhook deliveries

    MediumCVSS 6.4No exploitEPSS 0%

    cvat · computer vision annotation toolSep 10, 2024

  • CVE-2024-47063
    24Monitor

    Computer Vision Annotation Tool (CVAT) contains a stored XSS via the quality report data endpoint

    MediumCVSS 6.2No exploitEPSS 0%

    cvat · computer vision annotation toolSep 30, 2024

  • CVE-2026-58373
    21Monitor

    CVAT < 2.69.0 - Missing Authorization on Quality Reports parent_id Filter Leaks Cross-Organization Report Existence

    MediumCVSS 5.3No exploitEPSS 0%

    cvat · computer vision annotation toolJun 30, 2026

  • CVE-2025-48381
    21Monitor

    CVAT has information disclosure via browsable API

    MediumCVSS 5.3No exploitEPSS 0%

    cvat · computer vision annotation toolMay 30, 2025

  • CVE-2025-49135
    21Monitor

    CVAT missing validation for in-progress backup upload names

    MediumCVSS 5.3No exploitEPSS 0%

    cvat · computer vision annotation toolJun 25, 2025

  • CVE-2025-68430
    21Monitor

    CVAT vulnerable to directory traversal via mounted share listing

    MediumCVSS 5.3No exploitEPSS 0%

    cvat · computer vision annotation toolDec 19, 2025

  • CVE-2024-47172
    21Monitor

    Computer Vision Annotation Tool (CVAT) access control is broken in several PATCH endpoints

    MediumCVSS 5.4No exploitEPSS 0%

    cvat · computer vision annotation toolSep 30, 2024