Known vulnerabilities in Computer Vision Annotation Tool (CVAT)

Vendor: Intel
Software CPE: cpe:2.3:h:intel:computer_vision_annotation_tool_cvat:*:*:*:*:*:*:*:*
Total vulnerabilities: 28
Public exploits: 1
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Computer Vision Annotation Tool (CVAT) Computer Vision Annotation Tool (CVAT) is affected by 28 known vulnerabilities: 2 high, 9 medium, 17 low Critical High Medium Low

Vulnerabilities (28)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU140954 - Improper Validation of Consistency within Input
CVE-2026-73219
CWE-1288 Medium
No
No
2.72.0 05.08.2026 SB2026080510
#VU140953 - Incorrect Authorization
CVE-2026-73221
CWE-863 Medium
No
No
2.72.0 05.08.2026 SB2026080510
#VU138942 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-73220
CWE-79 Low
No
No
2.70.0 21.07.2026 SB20260721121
#VU133423 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-65986
CWE-79 Low
No
No
2.67.0 05.06.2026 SB2026060522
#VU132051 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-47682
CWE-22 Low
No
No
2.65.0 21.05.2026 SB2026052129
#VU132050 - Improper Authentication
CVE-2025-54573
CWE-287 Low
No
No
2.42.0 21.05.2026 SB2026052128
#VU129390 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-44369
CWE-79 Low
No
No
2.64.0 04.05.2026 SB2026050417
#VU127510 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-23516
CWE-79 Low
No
No
2.55.0 24.04.2026 SB2026042491
#VU127509 - Privilege Defined With Unsafe Actions
CVE-2026-23526
CWE-267 Low
No
No
2.55.0 24.04.2026 SB2026042491
#VU120253 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2025-68430
CWE-22 Low
No
No
2.53.0 23.12.2025 SB2025122317
#VU118174 - Improper Access Control
CVE-2025-64485
CWE-284 Medium
No
No
2.49.0 07.11.2025 SB2025110702
#VU113016 - Authorization Bypass Through User-Controlled Key
CVE-2025-49135
CWE-639 Medium
No
No
2.40.0 17.07.2025 SB2025071718
#VU109918 - Insertion of Sensitive Information Into Sent Data
CVE-2025-48381
CWE-201 Medium
No
No
2.38.0 29.05.2025 SB2025052966
#VU132049 - Deserialization of Untrusted Data
CVE-2025-23045
CWE-502 Medium
No
No
2.26.0 28.01.2025 SB2025012872
#VU97950 - Incorrect Authorization
CVE-2024-47172
CWE-863 Medium
No
No
2.19.1 02.10.2024 SB2024100222
#VU97946 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-47064
CWE-79 Low
No
No
2.19.0 02.10.2024 SB2024100218
#VU97942 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-47063
CWE-79 Low
No
No
2.19.0 02.10.2024 SB2024100218
#VU132048 - Missing Authorization
CVE-2024-45393
CWE-862 Low
No
No
2.18.0 10.09.2024 SB20240910158
#VU92127 - Cross-Site Request Forgery (CSRF)
CVE-2024-37164
CWE-352 Low
No
No
2.14.3 14.06.2024 SB2024061421
#VU92126 - Cross-Site Request Forgery (CSRF)
CVE-2024-37306
CWE-352 Low
No
No
2.14.3 14.06.2024 SB2024061421


Showing elements 1 - 20 out of 28