# cve.now: Tencent

The newest entries naming Tencent as an affected vendor (up to 200), of 45 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-125361](https://cve.now/CVE-2026-125361.md): Tencent BrowserSkill through 0.4.2 Missing Authentication in Local WebSocket Transport (CVSS 7.2)
- [CVE-2026-124586](https://cve.now/CVE-2026-124586.md): Tencent RapidJSON diyfp.h GetCachedPowerByIndex out-of-bounds (CVSS 6.9)
- [CVE-2026-118376](https://cve.now/CVE-2026-118376.md): WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses (CVSS 6.0)
- [CVE-2026-116620](https://cve.now/CVE-2026-116620.md): Tencent RapidJSON Regex stream.h Take out-of-bounds (CVSS 6.9)
- [CVE-2026-112074](https://cve.now/CVE-2026-112074.md): Tencent ncnn Conversion API mat\_pixel.cpp yuv420sp2rgb integer overflow (CVSS 5.3)
- [CVE-2026-112073](https://cve.now/CVE-2026-112073.md): Tencent ncnn MatMul matmul.cpp matmul\_transb out-of-bounds (CVSS 5.3)
- [CVE-2026-108821](https://cve.now/CVE-2026-108821.md): Tencent WeKnora SQL Validator inject.go validateSubquery sql injection (CVSS 5.3)
- [CVE-2026-101080](https://cve.now/CVE-2026-101080.md): Tencent AI-Infra-Guard File Access dir\_actions.py startsWith path traversal (CVSS 2.4)
- [CVE-2026-94111](https://cve.now/CVE-2026-94111.md): Tencent BrowserSkill through 0.3.0 Origin Validation Error in Local WebSocket Daemon (CVSS 6.9)
- [CVE-2026-89040](https://cve.now/CVE-2026-89040.md): Tencent Mass Service Engine in Cluster (MSEC) path traversal (CVSS 9.8)
- [CVE-2026-91750](https://cve.now/CVE-2026-91750.md): WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects (CVSS 7.1)
- [CVE-2026-84809](https://cve.now/CVE-2026-84809.md): Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecode (CVSS 7.1)
- [CVE-2026-72565](https://cve.now/CVE-2026-72565.md): Tencent APIJSON - Unauthenticated SQL Injection via @having Operator Map-Form Bypass (CVSS 9.8)
- [CVE-2026-50144](https://cve.now/CVE-2026-50144.md): ncnn: Out-of-bounds heap write in ParamDict::load\_param via unchecked negative parameter id (CVSS 7.1)
- [CVE-2026-15515](https://cve.now/CVE-2026-15515.md): Tencent PC Manager QMUDisk Driver qmudisk64.sys uncontrolled search path (CVSS 7.3)
- [CVE-2026-8786](https://cve.now/CVE-2026-8786.md): Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization (CVSS 5.3)
- [CVE-2026-5585](https://cve.now/CVE-2026-5585.md): Tencent AI-Infra-Guard Task Detail Endpoint task\_manager.go information disclosure (CVSS 6.9)
- [CVE-2026-30861](https://cve.now/CVE-2026-30861.md): WeKnora: Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation (CVSS 10.0)
- [CVE-2026-30860](https://cve.now/CVE-2026-30860.md): WeKnora: Remote Code Execution via SQL Injection Bypass in AI Database Query Tool (CVSS 10.0)
- [CVE-2026-30859](https://cve.now/CVE-2026-30859.md): WeKnora: Broken Access Control - Cross-Tenant Data Exposure (CVSS 5.3)
- [CVE-2026-30858](https://cve.now/CVE-2026-30858.md): WeKnora: DNS Rebinding Vulnerability in web\_fetch Tool Allows SSRF to Internal Resources (CVSS 6.5)
- [CVE-2026-30857](https://cve.now/CVE-2026-30857.md): WeKnora: Unauthorized Cross‑Tenant Knowledge Base Cloning (CVSS 5.3)
- [CVE-2026-30856](https://cve.now/CVE-2026-30856.md): WeKnora: Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection (CVSS 5.9)
- [CVE-2026-30855](https://cve.now/CVE-2026-30855.md): WeKnora: Broken Access Control in Tenant Management (CVSS 8.8)
- [CVE-2026-30247](https://cve.now/CVE-2026-30247.md): WeKnora: SSRF via Redirection (CVSS 5.9)
- [CVE-2026-22688](https://cve.now/CVE-2026-22688.md): WeKnora has Command Injection in MCP stdio test (CVSS 10.0)
- [CVE-2026-22687](https://cve.now/CVE-2026-22687.md): WeKnora vulnerable to SQL Injection (CVSS 5.6)
- [CVE-2025-13715](https://cve.now/CVE-2025-13715.md): Tencent FaceDetection-DSFD resnet Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8)
- [CVE-2025-13709](https://cve.now/CVE-2025-13709.md): Tencent TFace restore\_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8)
- [CVE-2025-13711](https://cve.now/CVE-2025-13711.md): Tencent TFace eval Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8)
- [CVE-2025-13706](https://cve.now/CVE-2025-13706.md): Tencent PatrickStar merge\_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8)
- [CVE-2025-13708](https://cve.now/CVE-2025-13708.md): Tencent NeuralNLP-NeuralClassifier \_load\_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8)
- [CVE-2025-13716](https://cve.now/CVE-2025-13716.md): Tencent MimicMotion create\_pipeline Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8)
- [CVE-2025-13714](https://cve.now/CVE-2025-13714.md): Tencent MedicalNet generate\_model Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8)
- [CVE-2025-13710](https://cve.now/CVE-2025-13710.md): Tencent HunyuanVideo load\_vae Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8)
- [CVE-2025-13707](https://cve.now/CVE-2025-13707.md): Tencent HunyuanDiT model\_resume Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8)
- [CVE-2025-13712](https://cve.now/CVE-2025-13712.md): Tencent HunyuanDiT merge Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8)
- [CVE-2025-13713](https://cve.now/CVE-2025-13713.md): Tencent Hunyuan3D-1 load\_pretrained Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8)
- [CVE-2025-11046](https://cve.now/CVE-2025-11046.md): Tencent WeKnora test testEmbeddingModel server-side request forgery (CVSS 6.9)
- [CVE-2024-39684](https://cve.now/CVE-2024-39684.md): Tencent RapidJSON include/rapidjson/reader.h GenericReader::ParseNumber() Function Template Exponent Parsing Integer Overflow (CVSS 6.8)
- [CVE-2024-38517](https://cve.now/CVE-2024-38517.md): Tencent RapidJSON include/rapidjson/reader.h GenericReader::ParseNumber() Function Template Exponent Parsing Integer Underflow (CVSS 6.8)
- [CVE-2021-27247](https://cve.now/CVE-2021-27247.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Tencent WeChat 2.9.5 desktop versi (CVSS 6.5)
- [CVE-2020-27874](https://cve.now/CVE-2020-27874.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent WeChat 7.0.18. (CVSS 8.8)
- [CVE-2019-17151](https://cve.now/CVE-2019-17151.md): This vulnerability allows remote attackers redirect users to an external resource on affected installations of Tencent WeChat Prior to 7.0.9 (CVSS 4.3)
- [CVE-2018-11616](https://cve.now/CVE-2018-11616.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Tencent Foxmail 7.2.9.115. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/tencent
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.