How severe is CVE-2026-73219?

CVE-2026-73219 has a CVSS 4.0 base score of 5.3, rated medium severity.

Is CVE-2026-73219 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (27th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-73219?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-73219 published?

CVE-2026-73219 was published on 2026-08-11 and last updated on 2026-08-12.

CVE-2026-73219

CVE-2026-73219 is a medium-severity vulnerability with a CVSS 4.0 base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1288.

Key facts

Severity: Medium (CVSS 4.0 base score 5.3)
EPSS exploit prediction: 0% (27th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-1288
Published: 2026-08-11
Last modified: 2026-08-12

Description

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with write access to a CVAT job can submit a batch automatic annotation request to RequestViewSet.create with inconsistent task and job IDs, and because the task ID determines the single active request slot, block automatic annotation for another task whose ID is known. This issue is fixed in version 2.72.0.

Frequently asked questions

What is CVE-2026-73219?: CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with write access to a CVAT job can submit a batch automatic annotation request to RequestViewSet.create with inconsistent task and job IDs, and because the task ID determines the single active request slot, block automatic annotation for another task whose ID is known. This issue is fixed in version 2.72.0.
How severe is CVE-2026-73219?: CVE-2026-73219 has a CVSS 4.0 base score of 5.3, rated medium severity.
Is CVE-2026-73219 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (27th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-73219?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-73219 published?: CVE-2026-73219 was published on 2026-08-11 and last updated on 2026-08-12.

References

Other CWE-1288 vulnerabilities

CVE-2026-31709 — High (CVSS 8.8): In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the whole DACL before…
CVE-2026-42982 — High (CVSS 7.8): Improper validation of consistency within input in Windows Secure Kernel Mode allows an authorized attacker to elevate…
CVE-2022-50976 — High (CVSS 7.7): A local attacker could cause a full device reset by resetting the device passwords using an invalid reset file via USB.
CVE-2024-39515 — High (CVSS 7.5): An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper…
CVE-2024-31136 — High (CVSS 7.4): In JetBrains TeamCity before 2024.03 2FA could be bypassed by providing a special URL parameter
CVE-2023-32701 — High (CVSS 7.1): Improper Input Validation in the Networking Stack of QNX SDP version(s) 6.6, 7.0, and 7.1 could allow an attacker to…

Browse all CWE-1288 vulnerabilities →