Cvat

CVAT is a narrowly focused computer-vision annotation tool that supports collaborative data labeling and model training pipelines, but its role in ML and data-processing workflows makes it a target for supply-chain and training-data compromise. Vulnerabilities affecting the product skew toward serious outcomes and frequently acquire public exploit code, with a moderate tendency toward confirmed in-the-wild exploitation; the recurring weakness classes—including cross-site scripting, server-side request forgery, authorization bypass, cross-site request forgery, and untrusted deserialization—reflect both the web-application attack surface and the data-handling trust boundaries inherent to annotation and model-preparation systems. Defenders deploying this tool should treat it as a network-boundary appliance, enforce strict authentication and input filtering, and monitor for supply-chain vectors; live severity, exploitation, and exposure counts are shown alongside this summary.