DeepSeek
Products
7- 3 CVEs
- 1 CVE
- 1 CVE
- 1 CVE
- 1 CVE
- 1 CVE
- 0 CVEs
Recent CVEs
5| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-95182 | Cri | 0.65 | 10.0 | — | Oct 16, 2026 | An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content. | ||
| CVE-2026-52394 | Cri | 0.59 | 9.1 | 0.00 | Oct 13, 2026 | DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input. | ||
| CVE-2025-26210 | Hig | 0.57 | 8.8 | 0.01 | Sep 3, 2025 | DeepSeek R1 through V3.1 allows XSS, as demonstrated by JavaScript execution in the context of the run-html-chat.deepseeksvc.com domain. NOTE: some third parties have indicated that this is intended behavior. | ||
| CVE-2026-55604 | Hig | 0.49 | 8.6 | 0.00 | Jul 9, 2026 | DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global `SessionStore` accepts caller-supplied `session_id` values without binding them to any authenticated principal or transport session. An attacker can… | ||
| CVE-2025-63872 | Med | 0.40 | 6.1 | 0.00 | Dec 2, 2025 | DeepSeek V3.2 has a Cross Site Scripting (XSS) vulnerability, which allows JavaScript execution through model-generated SVG content. |
- risk 0.65cvss 10.0epss —
An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.
- risk 0.59cvss 9.1epss 0.00
DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.
- risk 0.57cvss 8.8epss 0.01
DeepSeek R1 through V3.1 allows XSS, as demonstrated by JavaScript execution in the context of the run-html-chat.deepseeksvc.com domain. NOTE: some third parties have indicated that this is intended behavior.
- risk 0.49cvss 8.6epss 0.00
DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global `SessionStore` accepts caller-supplied `session_id` values without binding them to any authenticated principal or transport session. An attacker can…
- risk 0.40cvss 6.1epss 0.00
DeepSeek V3.2 has a Cross Site Scripting (XSS) vulnerability, which allows JavaScript execution through model-generated SVG content.