These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability in CVAT, an open-source interactive video and image annotation tool, allows an attacker to store malicious JavaScript in an annotation guide. This script can execute when another user opens the guide, potentially leading to arbitrary CVAT requests with the victim user's privileges. The vulnerability exists from version 2.68.0 until 2.70.0. Defenders should assess exposure and prioritize re [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-11T19:18:51.583Z and has not been modified since then. CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with the Worker role can use predictable task-based request IDs with the lambda request retrieve and destroy endpoints to vi [truncated]
A vulnerability in CVAT, an open-source interactive video and image annotation tool, allows a user with write access to a CVAT job to block automatic annotation for another task by submitting a batch automatic annotation request with inconsistent task and job IDs. This issue, fixed in version 2.72.0, has a CVSS score of 5.3 and is classified as MEDIUM severity.
The CVAT tool, used for computer vision tasks, contains a XSS vulnerability in versions 2.5.0 through 2.66.0. This vulnerability is accessible through annotation guide assets and can be exploited by influencing the media type of uploaded files. The issue has been fixed in version 2.67.0. Organizations using CVAT should be aware of this vulnerability and take steps to update to a patched version. The vulne [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-04T20:16:51.747Z and has not been modified since then. CVAT versions 1.6.0 through 2.64.0 are vulnerable to arbitrary file overwrite by an attacker with write access to a cloud storage added to the instance. Defenders managing CVAT instances, especially those with cloud storage integrations, should [truncated]
The Computer Vision Annotation Tool (CVAT) contains an improper authorization vulnerability, tracked as CVE-2026-58373, affecting CVAT versions before 2.69.0. This issue allows authenticated attackers to enumerate quality report identifiers belonging to other organizations by exploiting a missing check_object_permissions call on the parent_id query parameter of the quality reports API endpoint. The vulner [truncated]