en
Tencent is a global internet and technology company headquartered in Shenzhen, China. Its core business includes communication and social platforms, digital content and games, fintech, cloud computing, advertising, artificial intelligence, and enterprise technology services. It operates across international markets and supports both consumer and business use cases.
As of 11/08/2026, Tencent recorded 10 security vulnerabilities in the last 90 days across 7 products, including 3 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, WeKnora had the most security vulnerabilities in the Tencent ecosystem, with 3 vulnerabilities—approximately 30% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-118376WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 AddressesCVE-2026-116620Tencent RapidJSON Regex stream.h Take out-of-boundsCVE-2026-112074Tencent ncnn Conversion API mat_pixel.cpp yuv420sp2rgb integer overflowCVE-2026-112073Tencent ncnn MatMul matmul.cpp matmul_transb out-of-boundsCVE-2026-108821Tencent WeKnora SQL Validator inject.go validateSubquery sql injection| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-118376WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses | Exploitation statusNot exploited | FixYes |
| Published10/28/2026 |
| SeverityMedium |
CVE-2026-116620Tencent RapidJSON Regex stream.h Take out-of-bounds | Exploitation statusActively exploited | FixNo | Affected productRapidJSON | Published10/27/2026 | SeverityMedium |
|---|
CVE-2026-112074Tencent ncnn Conversion API mat_pixel.cpp yuv420sp2rgb integer overflow | Exploitation statusActively exploited | FixNo | Affected productncnn | Published10/19/2026 | SeverityMedium |
|---|
CVE-2026-112073Tencent ncnn MatMul matmul.cpp matmul_transb out-of-bounds | Exploitation statusActively exploited | FixNo | Affected productncnn | Published10/19/2026 | SeverityMedium |
|---|
CVE-2026-108821Tencent WeKnora SQL Validator inject.go validateSubquery sql injection | Exploitation statusActively exploited | FixYes | Affected productWeKnora | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-101080Tencent AI-Infra-Guard File Access dir_actions.py startsWith path traversal | Exploitation statusActively exploited | FixYes | Affected productAI-Infra-Guard | Published09/28/2026 | SeverityLow |
|---|
CVE-2026-94111Tencent BrowserSkill through 0.3.0 Origin Validation Error in Local WebSocket Daemon | Exploitation statusNot exploited | FixYes | Affected productBrowserSkill | Published09/20/2026 | SeverityMedium |
|---|
CVE-2026-91750Unvalidated HTTP redirects enable SSRF in Tencent WeKnora | Exploitation statusActively exploited | FixYes | Affected productWeKnora | Published09/15/2026 | SeverityHigh |
|---|
CVE-2026-89040Tencent Mass Service Engine in Cluster (MSEC) path traversal | Exploitation statusNot exploited | FixNo | Affected productMass Service Engine in Cluster (MSEC) | Published09/15/2026 | SeverityCritical |
|---|
CVE-2026-84809Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecode | Exploitation statusActively exploited | FixYes | Affected productAI-Infra-Guard | Published09/02/2026 | SeverityHigh |
|---|
CVE-2026-72565Tencent APIJSON - Unauthenticated SQL Injection via @having Operator Map-Form Bypass | Exploitation statusNot exploited | FixNo | Affected productAPIJSON | Published08/10/2026 | SeverityCritical |
|---|
CVE-2026-50144ncnn: Out-of-bounds heap write in ParamDict::load_param via unchecked negative parameter id | Exploitation statusActively exploited | FixYes | Affected productncnn | Published07/15/2026 | SeverityHigh |
|---|
CVE-2026-15515Tencent PC Manager QMUDisk Driver qmudisk64.sys uncontrolled search path | Exploitation statusActively exploited | FixNo | Affected productPC Manager | Published07/13/2026 | SeverityHigh |
|---|
CVE-2026-8786Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization | Exploitation statusActively exploited | FixNo | Affected productWeKnora | Published05/18/2026 | SeverityMedium |
|---|
CVE-2026-5585Tencent AI-Infra-Guard Task Detail Endpoint task_manager.go information disclosure | Exploitation statusActively exploited | FixNo | Affected productAI-Infra-Guard | Published04/05/2026 | SeverityMedium |
|---|
CVE-2026-30861WeKnora: Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation | Exploitation statusActively exploited | FixYes | Affected productWeKnora | Published03/07/2026 | SeverityCritical |
|---|
CVE-2026-30860WeKnora: Remote Code Execution via SQL Injection Bypass in AI Database Query Tool | Exploitation statusActively exploited | FixYes | Affected productWeKnora | Published03/07/2026 | SeverityCritical |
|---|
CVE-2026-30859WeKnora: Broken Access Control - Cross-Tenant Data Exposure | Exploitation statusActively exploited | FixYes | Affected productWeKnora | Published03/07/2026 | SeverityMedium |
|---|
CVE-2026-30858WeKnora: DNS Rebinding Vulnerability in web_fetch Tool Allows SSRF to Internal Resources | Exploitation statusActively exploited | FixYes | Affected productWeKnora | Published03/07/2026 | SeverityMedium |
|---|
CVE-2026-30857WeKnora: Unauthorized Cross‑Tenant Knowledge Base Cloning | Exploitation statusActively exploited | FixYes | Affected productWeKnora | Published03/07/2026 | SeverityMedium |
|---|
CVE-2026-30856WeKnora: Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection | Exploitation statusActively exploited | FixYes | Affected productWeKnora | Published03/07/2026 | SeverityMedium |
|---|
CVE-2026-30855WeKnora: Broken Access Control in Tenant Management | Exploitation statusActively exploited | FixYes | Affected productWeKnora | Published03/07/2026 | SeverityHigh |
|---|
CVE-2026-30247WeKnora: SSRF via Redirection | Exploitation statusActively exploited | FixYes | Affected productWeKnora | Published03/07/2026 | SeverityMedium |
|---|
CVE-2026-22688Command injection in Tencent WeKnora MCP stdio testing enables server-side subprocess execution | Exploitation statusActively exploited | FixYes | Affected productWeKnora | Published01/10/2026 | SeverityCritical |
|---|
CVE-2026-22687WeKnora vulnerable to SQL Injection | Exploitation statusActively exploited | FixYes | Affected productWeKnora | Published01/10/2026 | SeverityMedium |
|---|
CVE-2025-13716Tencent MimicMotion create_pipeline Deserialization of Untrusted Data Remote Code Execution Vulnerability | Exploitation statusNot exploited | FixNo | Affected productMimicMotion | Published12/23/2025 | SeverityHigh |
|---|
CVE-2025-13715Tencent FaceDetection-DSFD resnet Deserialization of Untrusted Data Remote Code Execution Vulnerability | Exploitation statusNot exploited | FixNo | Affected productFaceDetection-DSFD | Published12/23/2025 | SeverityHigh |
|---|
CVE-2025-13714Tencent MedicalNet generate_model Deserialization of Untrusted Data Remote Code Execution Vulnerability | Exploitation statusNot exploited | FixNo | Affected productMedicalNet | Published12/23/2025 | SeverityHigh |
|---|
CVE-2025-13713Tencent Hunyuan3D-1 load_pretrained Deserialization of Untrusted Data Remote Code Execution Vulnerability | Exploitation statusNot exploited | FixNo | Affected productHunyuan3D-1 | Published12/23/2025 | SeverityHigh |
|---|
CVE-2025-13712Tencent HunyuanDiT merge Deserialization of Untrusted Data Remote Code Execution Vulnerability | Exploitation statusNot exploited | FixNo | Affected productHunyuanDiT | Published12/23/2025 | SeverityHigh |
|---|
CVE-2025-13711Tencent TFace eval Deserialization of Untrusted Data Remote Code Execution Vulnerability | Exploitation statusNot exploited | FixNo | Affected productTFace | Published12/23/2025 | SeverityHigh |
|---|
CVE-2025-13710Tencent HunyuanVideo load_vae Deserialization of Untrusted Data Remote Code Execution Vulnerability | Exploitation statusNot exploited | FixNo | Affected productHunyuanVideo | Published12/23/2025 | SeverityHigh |
|---|
CVE-2025-13709Tencent TFace restore_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability | Exploitation statusNot exploited | FixNo | Affected productTFace | Published12/23/2025 | SeverityHigh |
|---|
CVE-2025-13708Tencent NeuralNLP-NeuralClassifier _load_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability | Exploitation statusNot exploited | FixNo | Affected productNeuralNLP-NeuralClassifier | Published12/23/2025 | SeverityHigh |
|---|
CVE-2025-13707Tencent HunyuanDiT model_resume Deserialization of Untrusted Data Remote Code Execution Vulnerability | Exploitation statusNot exploited | FixNo | Affected productHunyuanDiT | Published12/23/2025 | SeverityHigh |
|---|
CVE-2025-13706Tencent PatrickStar merge_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability | Exploitation statusNot exploited | FixNo | Affected productPatrickStar | Published12/23/2025 | SeverityHigh |
|---|
CVE-2025-11046Tencent WeKnora test testEmbeddingModel server-side request forgery | Exploitation statusActively exploited | FixNo | Affected productWeKnora | Published09/26/2025 | SeverityMedium |
|---|
CVE-2024-39684Tencent RapidJSON include/rapidjson/reader.h GenericReader::ParseNumber() Function Template Exponent Parsing Integer Overflow | Exploitation statusNot exploited | FixNo | Affected productRapidJSON | Published07/09/2024 | SeverityMedium |
|---|
CVE-2024-38517Tencent RapidJSON include/rapidjson/reader.h GenericReader::ParseNumber() Function Template Exponent Parsing Integer Underflow | Exploitation statusNot exploited | FixNo | Affected productRapidJSON | Published07/09/2024 | SeverityMedium |
|---|
CVE-2021-27247CVE-2021-27247 | Exploitation statusNot confirmed | FixNo | Affected productWeChat | Published04/14/2021 | SeverityMedium |
|---|
CVE-2020-27874CVE-2020-27874 | Exploitation statusNot confirmed | FixNo | Affected productWeChat | Published02/10/2021 | SeverityHigh |
|---|
CVE-2019-17151CVE-2019-17151 | Exploitation statusNot confirmed | FixNo | Affected productWeChat | Published01/07/2020 | SeverityMedium |
|---|
CVE-2018-11616CVE-2018-11616 | Exploitation statusNot confirmed | FixNo | Affected productTencent Foxmail | Published08/30/2018 | SeverityUnknown |
|---|
43 Results | Page 1 of 1