223 matches found
PT-2026-56972
Name of the Vulnerable Software and Affected Versions @arikusi/deepseek-mcp-server versions 1.4.2 through 1.7.x Description The self-hosted HTTP transport of the server exposes the POST /mcp endpoint without authentication. This occurs because the createMcpExpressApp function is called without an...
CVE-2026-55604: Authorization Bypass Through User-Controlled Key
DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global SessionStore accepts caller-supplied sessionid values without binding them to any authenticated principal or transport session. An attacker can enumerate active session I...
PT-2026-56971
Name of the Vulnerable Software and Affected Versions DeepSeek MCP Server versions 1.4.2 through 1.6.x Description The process-global SessionStore accepts caller-supplied session id values without binding them to an authenticated principal or transport session. This allows an attacker to enumerat...
CVE-2026-55605: Missing Authentication for Critical Function
DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.8.0, the self-hosted HTTP transport of @arikusi/deepseek-mcp-server exposes POST /mcp without any authentication: createMcpExpressApp is called without an authProvider and no middleware guards t...
-DeepSeek-RagFlow-Docker-
-DeepSeek-RagFlow-Docker- Rep...
AI-Generated Browser Ransomware Abuses Chromium API on Windows, Linux, macOS, Android
Cybersecurity researchers have flagged a new malware artifact generated using DeepSeek that constructed a novel attack path combining "unrealistic browser-malware concepts with a real browser capability" to turn it into a working ransomware technique that runs entirely inside the browser on both...
bespokelabs-curator (>=0.1.15rc1, <=0.1.15.post1), cornell (1.1.1) +21 more potentially affected by unknown CVE via vcrpy (7.0.0)
vcrpy PYPI version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on vcrpy and may be impacted: - bespokelabs-curator =0.1.15rc1, =1.0.0, =0.2.16, =0.1.1, =0.1.19, =0.1.9, =0.1.0, =0.2.4rc2, =0.3.22, =2.1.0, =0.1.0, =0.0.1, =1.0.2 and more Source...
15 Malicious JetBrains Plugins Caught Stealing DeepSeek, OpenAI API Keys
Hackers are using 15 malicious JetBrains plugins posing as AI coding assistants to steal DeepSeek, OpenAI, and other developer API keys...
MAL-2026-4667 Malicious code in seekcode (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f4fe5d868d0434123b1a29a739072fe0e0ec0f2efd1ceda4d2c16ccffecf105 When a user selects the advertised deepseek-cn provider, the package's defaultBaseUrlForProvider function in dist/chunk-6U42R724.js returns...
Malicious code in seekcode (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f4fe5d868d0434123b1a29a739072fe0e0ec0f2efd1ceda4d2c16ccffecf105 When a user selects the advertised deepseek-cn provider, the package's defaultBaseUrlForProvider function in dist/chunk-6U42R724.js returns...
DeepSeek TUI has SSRF IPV6 bypass
Summary Although SSRF is validated against hostnames that resolve to private IPv6 addresses, when providing the IPV6 in URL as http://::1, the SSRF defenses do not work. Details...
Server-side Request Forgery (SSRF)
Overview deepseek-tui is an Install and run deepseek and deepseek-tui binaries from GitHub release artifacts. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the fetchurl process. An attacker can gain unauthorized access to internal resources by supplying ...
NPM: DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval
NPM: DeepSeek TUI: runtests Tool Enables RCE via Malicious Repository Without Approval vulnerability discovered by ? in WordPress Npm deepseek-tui versions = 0.3.0, 0.8.23...
Arbitrary Code Injection
Overview deepseek-tui is an Install and run deepseek and deepseek-tui binaries from GitHub release artifacts. Affected versions of this package are vulnerable to Arbitrary Code Injection via the runtests process. An attacker can execute arbitrary code by introducing malicious test code into a...
NPM: DeepSeek TUI has SSRF via HTTP Redirect Bypass in fetch_url Tool
NPM: DeepSeek TUI has SSRF via HTTP Redirect Bypass in fetchurl Tool vulnerability discovered by ? in WordPress Npm deepseek-tui versions 0.8.22...
Server-side Request Forgery (SSRF)
Overview deepseek-tui is an Install and run deepseek and deepseek-tui binaries from GitHub release artifacts. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the fetchurl process. An attacker can access sensitive internal resources by supplying a URL that...
Kill-Chain Canaries: Stage-Level Tracking of Prompt Injection across Attack Surfaces and Model Safety Tiers
We present a stage-decomposed analysis of prompt injection attacks against five frontier LLM agents. Prior work measures task-level attack success rate ASR; we localize the pipeline stage at which each model's defense activates. We instrument every run with a cryptographic canary token...
CVE-2026-2589
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 12.8.3 via the automated Settings Backup stored in a publicly accessible file. This makes it possible for unauthenticated attackers to...
CVE-2026-2589
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 12.8.3 via the automated Settings Backup stored in a publicly accessible file. This makes it possible for unauthenticated attackers to...
CVE-2026-2589
The Greenshift WordPress plugin (animation and page builder blocks) is vulnerable to Sensitive Information Exposure in all versions up to 12.8.3 via an automated Settings Backup stored in a publicly accessible file. This allows unauthenticated attackers to extract configured API keys (OpenAI, Cla...