bytedance has 2 CVEs on record. 2 were published in the last 90 days. The median CVSS is 7.2 (high), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.2
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
2
Total CVEs
1
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-81735Critical· 10.0startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and …55CVE-2026-96680Medium· 4.3A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.236
bytedance vulnerabilities
CVEs affecting bytedance, newest first. Open any entry for full detail, references, and exploit status.
2 CVEsRSS
CVE-2026-96680Medium· 4.3PoCA vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2
A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. Affected by this vulnerability is the function chrome.runtime.onMessageExternal.addListener of the file static/background/index.js of the component External Me…
▾ TwilightByteDance · Coze Scraper ExtensionEPSS 0.45%via NVD
CVE-2026-81735Critical· 10.0startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and …
startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and …
▾ Midnightbytedance · UI-TARS-desktopEPSS 0.78%via NVD