Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
23 results
Aug 20, 2026CVAT is an open source interactive video and image annotation tool for computer vision.CVE-2026-73220 · Other software · cvat-ai · reported by GitHubHigh 8.5
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.68.0 until 2.70.0, the audio-task annotation guide renderer in cvat-ui/src/audio/components/annotation-page/audio-workspace/top-bar/audio-right-group.tsx passes attacker-controlled guide Markdown to MDEditor without the rehype-sanitize plugin. A user who can create or edit an annotation guide can store malicious JavaScript that executes when another user opens the guide. The script can issue arbitrary CVAT requests with the victim user's privileges. This issue is fixed in version 2.70.0.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026CVAT is an open source interactive video and image annotation tool for computer vision.CVE-2026-73221 · Other software · cvat-ai · reported by GitHubMedium 5.3
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with the Worker role can use predictable task-based request IDs with the lambda request retrieve and destroy endpoints to view automatic annotation requests for tasks or jobs the user cannot access and cancel requests initiated by other users. This issue is fixed in version 2.72.0.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026CVAT is an open source interactive video and image annotation tool for computer vision.CVE-2026-73219 · Other software · cvat-ai · reported by GitHubMedium 5.3
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with write access to a CVAT job can submit a batch automatic annotation request to RequestViewSet.create with inconsistent task and job IDs, and because the task ID determines the single active request slot, block automatic annotation for another task whose ID is known. This issue is fixed in version 2.72.0.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026CVAT is an open source interactive video and image annotation tool for computer vision.CVE-2026-65986 · Other software · cvat-ai · reported by GitHubHigh 8.5
CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.5.0 through 2.66.0 contain a XSS vulnerability that can be accessed through annotation guide assets. When CVAT serves the files attached to an annotation guide, it labels them with a media type ( Content-Type ) that the attacker can influence, so instead of treating an uploaded file as plain data, the victim's browser can be told to treat it as an HTML page and run any JavaScript inside it. This issue has been fixed in version 2.67.0.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026CVAT is an open source interactive video and image annotation tool for computer vision.CVE-2026-47682 · Other software · cvat-ai · reported by GitHubHigh 7.1
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.6.0 through 2.64.0, an attacker with write access to a cloud storage that's been added to a CVAT instance, or ability to add new cloud storages, is able to overwrite arbitrary files on the server's filesystem. This issue has been fixed in version 2.65.0.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2026CVAT before 2.69.0 contains an improper authorization vulnerability in QualityReportViewSet.get_queryset that allows authenticated attackers to enumerate qualitCVE-2026-58373 · Other software · cvat-ai · reported by VulnCheckMedium 5.3
CVAT before 2.69.0 contains an improper authorization vulnerability in QualityReportViewSet.get_queryset that allows authenticated attackers to enumerate quality report identifiers belonging to other organizations by exploiting a missing check_object_permissions call on the parent_id query parameter of the quality reports API endpoint. Attackers can send requests with sequential integer parent_id values and distinguish between existing and non-existing reports via HTTP 500 versus HTTP 404 response differences, disclosing cross-organization report existence without returning report content.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026CVAT is an open source interactive video and image annotation tool for computer vision.CVE-2026-44369 · Other software · cvat-ai · reported by GitHubHigh 8.5
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.5.0 to 2.63.0, an attacker who is able to create or edit an annotation guide on a task is able to add malicious JavaScript code, which will then run in the browser of anyone who opens this annotation guide. This code will be able to make arbitrary requests to CVAT with the victim user's privileges. This vulnerability is fixed in 2.64.0.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026CVAT is an open source interactive video and image annotation tool for computer vision.CVE-2026-23526 · Other software · cvat-ai · reported by GitHubHigh 8.5
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.0.0 through 2.54.0, users that have the staff status may freely change their permissions, including giving themselves superuser status and joining the admin group, which gives them full access to the data in the CVAT instance. Version 2.55.0 fixes the issue. As a workaround, review the list of users with staff status and revoke it from any users that are not expected to have superuser privileges.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026CVAT is an open source interactive video and image annotation tool for computer vision.CVE-2026-23516 · Other software · cvat-ai · reported by GitHubHigh 8.6
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.2.0 through 2.54.0, an attacker is able to execute arbitrary JavaScript in a victim user's CVAT UI session, provided that they are able to create a maliciously crafted label in a CVAT task or project, then get the victim user to either edit that label, or view a shape that refers to that label; and/or get the victim user to upload a maliciously crafted SVG image when configuring a skeleton. This gives the attacker temporary access to all CVAT resources that the victim user can access. Version 2.55.0 fixes the issue.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2025CVAT is an open source interactive video and image annotation tool for computer vision.CVE-2025-68430 · Other software · cvat-ai · reported by GitHubMedium 5.3
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.8.1 through 2.52.0, an attacker with an account on a CVAT instance is able to retrieve the contents of any file system directory accessible to the CVAT server. The exposed information is names of contained files and subdirectories. The contents of files are not accessible. Version 2.53.0 contains a patch. No known workarounds are available.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2025CVAT is an open source interactive video and image annotation tool for computer vision.CVE-2025-64485 · Other software · cvat-ai · reported by GitHubMedium 5.3
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.4.0 through 2.48.1, a malicious CVAT user with at least the User global role may create files in the root of the mounted file share, or overwrite existing files. If no file share is mounted, the user will be able to create files in the share directory of the import worker container, potentially filling up disk space. This issue is fixed in version 2.49.0.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2025CVAT is an open source interactive video and image annotation tool for computer vision.CVE-2025-54573 · Other software · cvat-ai · reported by GitHubMedium 4.3
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.1.0 through 2.41.0, email verification was not enforced when using Basic HTTP Authentication. As a result, users could create accounts using fake email addresses and use the product as verified users. Additionally, the missing email verification check leaves the system open to bot signups and further usage. CVAT 2.42.0 and later versions contain a fix for the issue. CVAT Enterprise customers have a workaround available; those customers may disable registration to prevent this issue.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2025CVAT is an open source interactive video and image annotation tool for computer vision.CVE-2025-49135 · Other software · cvat-ai · reported by GitHubMedium 5.3
CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.2.0 through 2.39.0 have no validation during the import process of a project or task backup to check that the filename specified in the query parameter refers to a TUS-uploaded file belonging to the same user. As a result, if an attacker with a CVAT account and a `user` role knows the filenames of other users' uploads, they could potentially access and steal data by creating projects or tasks using those files. This issue does not affect annotation or dataset TUS uploads, since in this case object-specific temporary directories are used. Users should upgrade to CVAT 2.40.0 or a later version to receive a patch. No known workarounds are available.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision.CVE-2025-48381 · Other software · cvat-ai · reported by GitHubMedium 5.3
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. In versions starting from 2.4.0 to before 2.38.0, an authenticated CVAT user may be able to retrieve the IDs and names of all tasks, projects, labels, and the IDs of all jobs and quality reports on the CVAT instance. In addition, if the instance contains many resources of a particular type, retrieving this information may tie up system resources, denying access to legitimate users. This issue has been patched in version 2.38.0.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision.CVE-2025-23045 · Other software · cvat-ai · reported by GitHubHigh 8.7
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with an account on an affected CVAT instance is able to run arbitrary code in the context of the Nuclio function container. This vulnerability affects CVAT deployments that run any of the serverless functions of type tracker from the CVAT Git repository, namely TransT and SiamMask. Deployments with custom functions of type tracker may also be affected, depending on how they handle state serialization. If a function uses an unsafe serialization library such as pickle or jsonpickle, it's likely to be vulnerable. Upgrade to CVAT 2.26.0 or later. If you are unable to upgrade, shut down any instances of the TransT or SiamMask functions you're running.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2024Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision.CVE-2024-47172 · Other software · cvat-ai · reported by GitHubMedium 5.4
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with a CVAT account may retrieve certain information about any project, task, job or membership resource on the CVAT instance. The information exposed in this way is the same as the information returned on a GET request to the resource. In addition, the attacker can also alter the default source and target storage associated with any project or task. Upgrade to CVAT 2.19.1 or any later version to fix the issue.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2024Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision.CVE-2024-47064 · Other software · cvat-ai · reported by GitHubMedium 6.3
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. If an attacker can trick a logged-in CVAT user into visiting a maliciously-constructed URL, they can initiate any API calls on that user's behalf. This gives the attacker temporary access to all data that the victim user has access to. Upgrade to CVAT 2.19.0 or a later version to fix this issue.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2024Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision.CVE-2024-47063 · Other software · cvat-ai · reported by GitHubMedium 6.2
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. If a malicious CVAT user with permissions to either create a task, or edit an existing task can trick another logged-in user into visiting a maliciously-constructed URL, they can initiate any API calls on that user's behalf. This gives the attacker temporary access to all data that the victim user has access to. Upgrade to CVAT 2.19.0 or a later version to fix this issue.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision.CVE-2024-45393 · Other software · cvat-ai · reported by GitHubMedium 6.4
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with a CVAT account can access webhook delivery information for any webhook registered on the CVAT instance, including that of other users. For each delivery, this contains information about the event that caused the delivery, typically including full details about the object on which an action was performed (such as the task for an "update:task" event), and the user who performed the action. In addition, the attacker can redeliver any past delivery of any webhook, and trigger a ping event for any webhook. Upgrade to CVAT 2.18.0 or any later version.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2024Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision.CVE-2024-37306 · Other software · cvat-ai · reported by GitHubHigh 7.1
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Starting in version 2.2.0 and prior to version 2.14.3, if an attacker can trick a logged-in CVAT user into visiting a malicious URL, they can initiate a dataset export or a backup from a project, task or job that the victim user has permission to export into a cloud storage that the victim user has access to. The name of the resulting file can be chosen by the attacker. This implies that the attacker can overwrite arbitrary files in any cloud storage that the victim can access and, if the attacker has read access to the cloud storage used in the attack, they can obtain media files, annotations, settings and other information from any projects, tasks or jobs that the victim has permission to export. Version 2.14.3 contains a fix for the issue. No known workarounds are available.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2024Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision.CVE-2024-37164 · Other software · cvat-ai · reported by GitHubHigh 7.1
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. CVAT allows users to supply custom endpoint URLs for cloud storages based on Amazon S3 and Azure Blob Storage. Starting in version 2.1.0 and prior to version 2.14.3, an attacker with a CVAT account can exploit this feature by specifying URLs whose host part is an intranet IP address or an internal domain name. By doing this, the attacker may be able to probe the network that the CVAT backend runs in for HTTP(S) servers. In addition, if there is a web server on this network that is sufficiently API-compatible with an Amazon S3 or Azure Blob Storage endpoint, and either allows anonymous access, or allows authentication with credentials that are known by the attacker, then the attacker may be able to create a cloud storage linked to this server. They may then be able to list files on the server; extract files from the server, if these files are of a type that CVAT supports reading from cloud storage (media data (such as images/videos/archives), importable annotations or datasets, task/project backups); and/or overwrite files on this server with exported annotations/datasets/ba
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Server-side request forgery in the CVAT software maintained by Intel(R) before version 2.0.1 may allow an authenticated user to potentially enable information dCVE-2022-27234 · Other software · Intel · reported by secure@intel.comMedium 4.3
Server-side request forgery in the CVAT software maintained by Intel(R) before version 2.0.1 may allow an authenticated user to potentially enable information disclosure via network access.
- Product
- Computer Vision Annotation Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2022CVAT is an opensource interactive video and image annotation tool for computer vision.CVE-2022-31188 · Other software · cvat-ai · reported by GitHubHigh 8.6
CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were found to be subject to a Server-side request forgery (SSRF) vulnerability. Validation has been added to urls used in the affected code path in version 2.0.0. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.