目標達成 すべての支援者に感謝 — 100%達成しました！

目標: 1000 CNY · 調達済み: 1336 CNY

100%
コーヒーを一杯おごる

cvat-ai 厂商漏洞列表 / CVE 中文分析 21

cvat-ai 厂商相关 21 条 CVE 漏洞，含 AI 中文分析、POC、CVSS 评分与受影响产品。

CVAT-AI 是一款开源的计算机视觉标注平台，主要用于图像和视频数据集的标注与管理。历史上，该平台常见漏洞类型包括远程代码执行、跨站脚本攻击和权限绕过问题。截至最新统计，已记录 15 条 CVE 漏洞，多数与输入验证不足和身份认证缺陷相关。安全社区建议用户及时更新至最新版本，并实施严格的访问控制措施以降低潜在风险。

上位製品 cvat-ai: cvat
CVE IDタイトルCVSS深刻度公開日
CVE-2026-73221 CVAT: Flawed authorization logic in endpoints related to lambda requests — cvatCWE-863 5.3 Medium2026-08-11
CVE-2026-73219 CVAT: Denial of service with regards to automatic annotation — cvatCWE-1288 5.3 Medium2026-08-11
CVE-2026-65986 CVAT has stored XSS via annotation guide assets — cvatCWE-79 8.5 High2026-08-04
CVE-2026-47682 CVAT: Missing path-containment validation in multiple entry points allows arbitrary path writes — cvatCWE-22 7.1 High2026-08-04
CVE-2026-58373 CVAT < 2.69.0 - Missing Authorization on Quality Reports parent_id Filter Leaks Cross-Organization Report Existence — cvatCWE-862 4.3 Medium2026-06-30
CVE-2026-44369 CVAT: Stored XSS via annotation guides — cvatCWE-80--2026-05-13
CVE-2026-23526 CVAT vulnerable to privilege escalation of users with staff status — cvatCWE-267 6.5AIMediumAI2026-01-21
CVE-2026-23516 CVAT vulnerable to XSS via skeleton SVG images — cvatCWE-83 6.5AIMediumAI2026-01-21
CVE-2025-68430 CVAT vulnerable to directory traversal via mounted share listing — cvatCWE-24 4.3AIMediumAI2025-12-19
CVE-2025-64485 CVAT: Mounted share file overwrite via crafted request — cvatCWE-22 7.1 -2025-11-07
CVE-2025-54573 CVAT vulnerable to email verification bypass by use of basic authentication — cvatCWE-287 4.3 Medium2025-07-30
CVE-2025-49135 CVAT missing validation for in-progress backup upload names — cvatCWE-639 6.5AIMediumAI2025-06-25
CVE-2025-48381 CVAT has information disclosure via browsable API — cvatCWE-201 4.3AIMediumAI2025-05-30
CVE-2025-23045 CVAT allows remote code execution via tracker Nuclio functions — cvatCWE-502 8.8 -2025-01-28
CVE-2024-47172 Computer Vision Annotation Tool (CVAT) access control is broken in several PATCH endpoints — cvatCWE-863 5.4 Medium2024-09-30
CVE-2024-47064 Computer Vision Annotation Tool (CVAT) contains a reflected XSS via request endpoints — cvatCWE-79 6.5 -2024-09-30
CVE-2024-47063 Computer Vision Annotation Tool (CVAT) contains a stored XSS via the quality report data endpoint — cvatCWE-79 6.5 -2024-09-30
CVE-2024-45393 Computer Vision Annotation Tool (CVAT) is missing authorization for endpoints related to webhook deliveries — cvatCWE-862 6.4 Medium2024-09-10
CVE-2024-37306 CVAT's export and backup-related API endpoints are susceptible to CSRF — cvatCWE-352 7.1 High2024-06-13
CVE-2024-37164 CVAT SSRF via custom cloud storage endpoints — cvatCWE-918 7.1 High2024-06-13
CVE-2022-31188 Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT) — cvatCWE-918 8.6 High2022-08-01

本页汇总了 cvat-ai 厂商截至目前公开的全部 21 条 CVE 漏洞。每条漏洞均包含 CVSS 评分、CWE 弱点分类、受影响产品与参考链接，并附带 AI 生成的中文分析以便快速判断风险。