{"items":[{"id":"CVE-2026-96680","published":"2026-09-23T23:00:11.989Z","updated":"2026-09-24T13:13:38.289Z","title":"ByteDance Coze Scraper Extension External Message index.js chrome.runtime.onMessageExternal.addListener authorization","severity":"MEDIUM","score":5.3,"vendor":"ByteDance","product":"Coze Scraper Extension","kev":false,"epss":0.00445,"kevAdded":null},{"id":"CVE-2026-81735","published":"2026-08-27T14:51:20.291Z","updated":"2026-09-24T14:19:51.924Z","title":"UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Execution","severity":"CRITICAL","score":10,"vendor":"bytedance","product":"UI-TARS-desktop","kev":false,"epss":0.00779,"kevAdded":null},{"id":"CVE-2026-11312","published":"2026-06-05T00:30:14.091Z","updated":"2026-06-05T13:12:50.570Z","title":"bytedance InfiniStore KV Map infinistore.h purge_kv_map algorithmic complexity","severity":"MEDIUM","score":4.8,"vendor":"bytedance","product":"InfiniStore","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-7023","published":"2026-04-26T06:30:15.273Z","updated":"2026-04-27T17:00:29.181Z","title":"ByteDance coze-studio databaseTool database_impl.go ExecuteSQL sql injection","severity":"MEDIUM","score":5.3,"vendor":"ByteDance","product":"coze-studio","kev":false,"epss":0.00365,"kevAdded":null},{"id":"CVE-2026-6878","published":"2026-04-23T00:00:20.300Z","updated":"2026-04-23T12:49:00.762Z","title":"ByteDance verl grader.py math_equal sandbox","severity":"MEDIUM","score":6.3,"vendor":"ByteDance","product":"verl","kev":false,"epss":0.00333,"kevAdded":null},{"id":"CVE-2026-40518","published":"2026-04-17T16:43:42.387Z","updated":"2026-08-14T16:49:50.704Z","title":"ByteDance DeerFlow Path Traversal and Arbitrary File Write via Bootstrap Mode","severity":"HIGH","score":7.1,"vendor":"bytedance","product":"deer-flow","kev":false,"epss":0.00356,"kevAdded":null}]}