CVE-2026-73219None▾ SunlitCVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with write access to a CVAT job can submit a batch automatic annotation request to RequestViewSet.create with incons…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with write access to a CVAT job can submit a batch automatic annotation request to RequestViewSet.create with inconsistent task and job IDs, and because the task ID determines the single active request slot, block automatic annotation for another task whose ID is known. This issue is fixed in version 2.72.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-89584High· 7.0kernel: block: validate user space vectors during extraction (CVE-2026-89584)
CVE-2026-46117High· 7.8In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Sashiko points out that the user can specify WQs sharing the same CQ as a part of the uAPI and …
CVE-2026-69793High· 7.5Improper validation of consistency within input in Windows TCP/IP allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-18238Medium· 5.0The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers
CVE-2026-15943Medium· 5.5A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers
CVE-2026-18209Low· 3.4A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows