Skip to content
OpenAdvisories

Vendor

bytedance

8 known vulnerabilities.

Products

DeerFlow 2 deer-flow 1 Coze Scraper Extension 1 UI-TARS-desktop 1 verl 1 InfiniStore 1 coze-studio 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 10.0
    CVE-2026-81735

    UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Execution

    startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and its authentication mid…

    bytedance UI-TARS-desktop