How many CVEs have a located fix in cvat-ai/cvat?

22 published CVEs have a fix traced to functions in cvat-ai/cvat, touching 81 functions across 29 files.

Which function in cvat-ai/cvat has been patched by the most CVEs?

retrieve in cvat/apps/engine/views.py has been changed by 2 CVE fixes, from 2024 to 2026.

How large is a typical CVE fix in cvat-ai/cvat?

The median fix changes 19 lines. 55% of fixes change 20 lines or fewer, and 14% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

python

typescript

#234 of 500 repositories

cvat-ai/cvat

Name: cvat-ai/cvat: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix August 20, 2026

22

CVE fixes located

Published CVEs

81

Functions patched

Distinct function sites

29

Files patched

Distinct source files

2022–2026

Years covered

By CVE publication date

Overview

22 published CVEs have a fix traced to functions in cvat-ai/cvat, the earliest published in 2022. Those fixes changed 81 distinct functions across 29 files, in 272 patch hunks.

Among the 500 repositories tracked here, cvat-ai/cvat ranks #234 by the number of CVEs with a located fix.

Most patched functions

Functions in cvat-ai/cvat changed by the most CVE fixes.

Most patched files

Files in cvat-ai/cvat changed by the most CVE fixes.

1cvat/apps/engine/views.py6 CVEs · 17 functions
2cvat/apps/engine/serializers.py4 CVEs · 5 functions
3cvat/apps/lambda_manager/views.py3 CVEs · 9 functions
4cvat/apps/engine/backup.py3 CVEs · 4 functions
5cvat/apps/engine/task.py2 CVEs · 7 functions
6cvat/apps/engine/mixins.py2 CVEs · 5 functions
7cvat/apps/engine/permissions.py2 CVEs · 3 functions
8cvat/apps/lambda_manager/permissions.py2 CVEs · 2 functions
9cvat/apps/quality_control/views.py2 CVEs · 2 functions
10cvat/apps/engine/cache.py1 CVEs · 3 functions

Fix size

How much code a CVE fix in cvat-ai/cvat changes, with backports counted once.

19

Median lines changed

Added plus removed, per CVE

55%

Fixes of 20 lines or fewer

Share of CVE fixes

14%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in cvat-ai/cvat, and the functions each fix changed.

CVAT: Stored XSS via annotation guides in audio tasks
CVE-2026-73220AudioRightGroup Props
High · CVSS 8.5
EPSS 0.5%2026-08-20
CVAT: Flawed authorization logic in endpoints related to lambda requests
CVE-2026-73221LambdaRequestPermission get_job create
Medium · CVSS 5.3
EPSS 0.4%2026-08-11
CVAT: Denial of service with regards to automatic annotation
CVE-2026-73219LambdaRequestPermission get_job create
Medium · CVSS 5.3
EPSS 0.5%2026-08-11
CVAT has stored XSS via annotation guide assets
CVE-2026-65986retrieve validate_file
High · CVSS 8.5
EPSS 0.4%2026-08-04
CVAT: Missing path-containment validation in multiple entry points allows arbitrary path writes
CVE-2026-47682problem_with_untrusted_path _validate_ri_path CanonicalRelativePathValidator
High · CVSS 7.1
EPSS 0.5%2026-08-04
CVAT < 2.69.0 - Missing Authorization on Quality Reports parent_id Filter Leaks Cross-Organization Report Existence
CVE-2026-58373create create_scope_view get_queryset
Medium · CVSS 5.3
EPSS 0.3%2026-06-30
CVAT: Stored XSS via annotation guides
CVE-2026-44369AnnotationGuidePage Props RightGroup
High · CVSS 8.5
EPSS 0.4%2026-05-13
CVAT vulnerable to privilege escalation of users with staff status
CVE-2026-23526_get_scopes validate get_serializer_class
High · CVSS 8.5
EPSS 0.3%2026-01-21
CVAT vulnerable to XSS via skeleton SVG images
CVE-2026-23516SkeletonConfigurator parseUntrustedSvg makeSVGFromTemplate
High · CVSS 8.6
EPSS 0.2%2026-01-21
CVAT vulnerable to directory traversal via mounted share listing
CVE-2025-68430share
Medium · CVSS 5.3
EPSS 0.3%2025-12-19
CVAT: Mounted share file overwrite via crafted request
CVE-2025-64485_import_task Meta serialize_data
Medium · CVSS 5.3
EPSS 0.4%2025-11-07
CVAT vulnerable to email verification bypass by use of basic authentication
CVE-2025-54573BasicAuthenticationEx BasicAuthenticationScheme generate_secret_key
Medium · CVSS 6.5
EPSS 0.3%2025-07-30

Get an alert for each new cvat-ai/cvat CVE, with the patched functions and AI-written analysis.

Monitor cvat CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

BerriAI/litellm22 CVEs cockpit-hq/cockpit22 CVEs exponentcms/exponent-cms22 CVEs frappe/erpnext22 CVEs GNOME/libxml222 CVEs libgd/libgd22 CVEs nuxt/nuxt22 CVEs OctoPrint/OctoPrint22 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in cvat-ai/cvat.

How many CVEs have a located fix in cvat-ai/cvat?: 22 published CVEs have a fix traced to functions in cvat-ai/cvat, touching 81 functions across 29 files.
Which function in cvat-ai/cvat has been patched by the most CVEs?: retrieve in cvat/apps/engine/views.py has been changed by 2 CVE fixes, from 2024 to 2026.
How large is a typical CVE fix in cvat-ai/cvat?: The median fix changes 19 lines. 55% of fixes change 20 lines or fewer, and 14% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track cvat-ai/cvat CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing