WeKnora
- Software type
- AI and machine learning platform
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/08/2026, WeKnora recorded 3 security vulnerabilities in the last 90 days, of which 1 is rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of WeKnora and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-118376WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 AddressesCVE-2026-108821Tencent WeKnora SQL Validator inject.go validateSubquery sql injectionCVE-2026-91750Unvalidated HTTP redirects enable SSRF in Tencent WeKnoraCVE-2026-8786Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorizationCVE-2026-30861WeKnora: Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-118376WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses | Exploitation statusNot exploited | FixYes |
| SeverityMedium |
CVE-2026-108821Tencent WeKnora SQL Validator inject.go validateSubquery sql injection | Exploitation statusActively exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-91750Unvalidated HTTP redirects enable SSRF in Tencent WeKnora | Exploitation statusActively exploited | FixYes | Published09/15/2026 | SeverityHigh |
|---|
CVE-2026-8786Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization | Exploitation statusActively exploited | FixNo | Published05/18/2026 | SeverityMedium |
|---|
CVE-2026-30861WeKnora: Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation | Exploitation statusActively exploited | FixYes | Published03/07/2026 | SeverityCritical |
|---|
CVE-2026-30860WeKnora: Remote Code Execution via SQL Injection Bypass in AI Database Query Tool | Exploitation statusActively exploited | FixYes | Published03/07/2026 | SeverityCritical |
|---|
CVE-2026-30859WeKnora: Broken Access Control - Cross-Tenant Data Exposure | Exploitation statusActively exploited | FixYes | Published03/07/2026 | SeverityMedium |
|---|
CVE-2026-30858WeKnora: DNS Rebinding Vulnerability in web_fetch Tool Allows SSRF to Internal Resources | Exploitation statusActively exploited | FixYes | Published03/07/2026 | SeverityMedium |
|---|
CVE-2026-30857WeKnora: Unauthorized Cross‑Tenant Knowledge Base Cloning | Exploitation statusActively exploited | FixYes | Published03/07/2026 | SeverityMedium |
|---|
CVE-2026-30856WeKnora: Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection | Exploitation statusActively exploited | FixYes | Published03/07/2026 | SeverityMedium |
|---|
CVE-2026-30855WeKnora: Broken Access Control in Tenant Management | Exploitation statusActively exploited | FixYes | Published03/07/2026 | SeverityHigh |
|---|
CVE-2026-30247WeKnora: SSRF via Redirection | Exploitation statusActively exploited | FixYes | Published03/07/2026 | SeverityMedium |
|---|
CVE-2026-22688Command injection in Tencent WeKnora MCP stdio testing enables server-side subprocess execution | Exploitation statusActively exploited | FixYes | Published01/10/2026 | SeverityCritical |
|---|
CVE-2026-22687WeKnora vulnerable to SQL Injection | Exploitation statusActively exploited | FixYes | Published01/10/2026 | SeverityMedium |
|---|
CVE-2025-11046Tencent WeKnora test testEmbeddingModel server-side request forgery | Exploitation statusActively exploited | FixNo | Published09/26/2025 | SeverityMedium |
|---|
15 Results | Page 1 of 1