Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/Tencent/WeKnora

10 known vulnerabilities (3 critical, 1 high, 6 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
10 · 3 critical, 1 high, 6 medium
Registry
pkg.go.dev

Advisories 10

  • CVE-2026-30861Critical 10.0

    WeKnora: Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation

    Affected: from 0.2.5, fixed in 0.2.10; from 0.2.6, fixed in 0.2.10.

  • CVE-2026-30860Critical 10.0

    WeKnora: Remote Code Execution via SQL Injection Bypass in AI Database Query Tool

    Affected: all versions; fixed in 0.2.12.

  • CVE-2026-30859Medium 5.3

    WeKnora: Broken Access Control - Cross-Tenant Data Exposure

    Affected: fixed in 0.2.12; all versions.

  • CVE-2026-30858Medium 6.5

    WeKnora: DNS Rebinding Vulnerability in web_fetch Tool Allows SSRF to Internal Resources

    Affected: fixed in 0.3.0; all versions.

  • CVE-2026-30857Medium 5.3

    WeKnora: Unauthorized Cross‑Tenant Knowledge Base Cloning

    Affected: all versions; fixed in 0.3.0.

  • CVE-2026-30856Medium 5.9

    WeKnora: Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection

    Affected: all versions; fixed in 0.3.0.

  • WeKnora: Broken Access Control in Tenant Management

    Affected: fixed in 0.3.1; fixed in 0.3.2.

  • CVE-2026-30247Medium 5.9

    WeKnora: SSRF via Redirection

    Affected: fixed in 0.2.12.

  • CVE-2026-22688Critical 10.0

    WeKnora has Command Injection in MCP stdio test

    Affected: fixed in 0.2.5.

  • CVE-2026-22687Medium 5.6

    WeKnora vulnerable to SQL Injection

    Affected: fixed in 0.2.5.