Tencent vulnerabilities
45 CVEs and advisories name Tencent as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-125361Tencent BrowserSkill through 0.4.2 Missing Authentication in Local WebSocket Transport
- CVE-2026-124586Tencent RapidJSON diyfp.h GetCachedPowerByIndex out-of-bounds
- CVE-2026-118376WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses
- CVE-2026-116620Tencent RapidJSON Regex stream.h Take out-of-bounds
- CVE-2026-112074Tencent ncnn Conversion API mat_pixel.cpp yuv420sp2rgb integer overflow
- CVE-2026-112073Tencent ncnn MatMul matmul.cpp matmul_transb out-of-bounds
- CVE-2026-108821Tencent WeKnora SQL Validator inject.go validateSubquery sql injection
- CVE-2026-101080Tencent AI-Infra-Guard File Access dir_actions.py startsWith path traversal
- CVE-2026-94111Tencent BrowserSkill through 0.3.0 Origin Validation Error in Local WebSocket Daemon
- CVE-2026-89040Tencent Mass Service Engine in Cluster (MSEC) path traversal
- CVE-2026-91750WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects
- CVE-2026-84809Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecode
- CVE-2026-72565Tencent APIJSON - Unauthenticated SQL Injection via @having Operator Map-Form Bypass
- CVE-2026-50144ncnn: Out-of-bounds heap write in ParamDict::load_param via unchecked negative parameter id
- CVE-2026-15515Tencent PC Manager QMUDisk Driver qmudisk64.sys uncontrolled search path
- CVE-2026-8786Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization
- CVE-2026-5585Tencent AI-Infra-Guard Task Detail Endpoint task_manager.go information disclosure
- CVE-2026-30861WeKnora: Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation
- CVE-2026-30860WeKnora: Remote Code Execution via SQL Injection Bypass in AI Database Query Tool
- CVE-2026-30859WeKnora: Broken Access Control - Cross-Tenant Data Exposure
- CVE-2026-30858WeKnora: DNS Rebinding Vulnerability in web_fetch Tool Allows SSRF to Internal Resources
- CVE-2026-30857WeKnora: Unauthorized Cross‑Tenant Knowledge Base Cloning
- CVE-2026-30856WeKnora: Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection
- CVE-2026-30855WeKnora: Broken Access Control in Tenant Management
- CVE-2026-30247WeKnora: SSRF via Redirection
- CVE-2026-22688WeKnora has Command Injection in MCP stdio test
- CVE-2026-22687WeKnora vulnerable to SQL Injection
- CVE-2025-13715Tencent FaceDetection-DSFD resnet Deserialization of Untrusted Data Remote Code Execution Vulnerability
- CVE-2025-13709Tencent TFace restore_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability
- CVE-2025-13711Tencent TFace eval Deserialization of Untrusted Data Remote Code Execution Vulnerability