DeepSeek has 4 CVEs on record. 4 were published in the last 90 days. The median CVSS is 6.8 (medium), with 1 rated critical. Most affected products: Harness (2), DeepSeek Harness (1), deepseek-harness (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.8
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Products
- Harness 2
- DeepSeek Harness 1
- deepseek-harness 1
Worst active — by depth score
CVE-2026-82533Critical· 9.6DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the a…53CVE-2026-116368High· 7.3DeepSeek Harness Browser Auth browser-auth.ts improper authorization40CVE-2026-116367Medium· 6.3DeepSeek Harness sandbox.ts createContext35CVE-2026-101132Low· 3.1A security flaw has been discovered in DeepSeek deepseek-harness up to 0.1.7-rc.229
DeepSeek vulnerabilities
CVEs affecting DeepSeek, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-116367Medium· 6.3DeepSeek Harness sandbox.ts createContext
A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is pos…
CVE-2026-116368High· 7.3DeepSeek Harness Browser Auth browser-auth.ts improper authorization
A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. This issue affects some unknown processing of the file packages/client/connection/src/browser-auth.ts of the component Browser Auth. This manipulation causes improper a…
CVE-2026-101132Low· 3.1PoCA security flaw has been discovered in DeepSeek deepseek-harness up to 0.1.7-rc.2
A security flaw has been discovered in DeepSeek deepseek-harness up to 0.1.7-rc.2. The affected element is the function loadProfile of the file packages/boot/app-boot/src/profile.ts of the component Bundle Patch Handler. The manipulation…
CVE-2026-82533Critical· 9.6DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the a…
DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the a…