CVE-2026-81735 UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Execution

startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and its authentication middleware was optional: middlewares are...

CVE-2026-81735 UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Execution

startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and its authentication middleware was optional: middlewares are...

CVE-2026-81735 UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Execution

startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and its authentication middleware was optional: middlewares are...

CVE-2026-81685 openssl_encrypt before 1.4.9 Text Injection via Recovery Slot Metadata

opensslencrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing bi...

CVE-2026-81685

opensslencrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing bi...

CVE-2026-81685 openssl_encrypt before 1.4.9 Text Injection via Recovery Slot Metadata

opensslencrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing bi...

CVE-2026-81685

openssl_encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI. Attackers can craft encrypted files with malicious slot identifiers containing bidi overrides or line-separator characters, injecting forged text into the irreversible-removal confirmation dialog and...

CVE-2026-81685 openssl_encrypt before 1.4.9 Text Injection via Recovery Slot Metadata

opensslencrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing bi...

CVE-2026-81682 openssl_encrypt before 1.4.9 Insecure File Permissions

opensslencrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems...

EUVD-2026-67038

opensslencrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems...

CVE-2026-81682

opensslencrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems...

CVE-2026-81682 openssl_encrypt before 1.4.9 Insecure File Permissions

opensslencrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems...

CVE-2026-81682

openssl_encrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI. The GUI writes decrypted plaintext with world-readable default permissions , allowing unprivileged local users on multi-user systems to read decrypted output files. The CVSS 3.1 score is 6...

CVE-2026-81682 openssl_encrypt before 1.4.9 Insecure File Permissions

opensslencrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems...

CVE-2026-3888

CVE-2026-3888 - snap-confine + systemd-tmpfiles Escalação de Privilégios Local Aviso: Este repositório é apenas para fins educacionais. Todo o conteúdo é baseado no aviso de segurança original publicado pela Qualys em 17 de março de 2026. A vulnerabilidade já foi corrigida — garanta sempre que se...

EUVD-2026-66379

Improper neutralization of path traversal sequences in TeamViewer Desktop Clients prior Version 15.81.5 allows an authenticated remote session participant to write files to unintended locations on the local file system via file transfer or virtual file clipboard mechanisms. An attacker can levera...

Installer for Rakuten Kobo Desktop Application (Windows version) may insecurely load Dynamic Link Libraries

Overview The installer for Rakuten Kobo Desktop Application Windows version contains the following vulnerability in the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. Uncontrolled search path element CWE-427 - CVE-2026-68955 Yukihiro Nakamura reported this...

PT-2026-82586

openssl encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing...

CVE-2026-81735: Missing Authentication for Critical Function

startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and its authentication middleware was optional: middlewares are...

CVE-2026-75357

Bilibili Desktop v.1.17.9 is affected by a vulnerability that allows a remote attacker to achieve arbitrary code execution . The root cause involves the bili-inject.js and bili-bridge.js components. The issue is categorized as an Improper Control of Generation of Code . No specific remediation st...