Tencent vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-89040 Tencent Mass Service Engine in Cluster (MSEC) allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on theCritical 9.3 · Sep 15, 2026
• CVE-2026-91750 WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from uHigh 7.1 · Sep 14, 2026
• CVE-2026-84809 Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories and .pyc/.pyo/.pyd extHigh 7.1 · Sep 2, 2026
• CVE-2026-72565 A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary datCritical 9.8 · Aug 10, 2026
• CVE-2026-50144 ncnn is a high-performance neural network inference framework optimized for the mobile platform.High 7.1 · Jul 15, 2026
• CVE-2026-30861 WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval.Critical 9.9 · Mar 7, 2026
• CVE-2026-30860 WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval.Critical 9.9 · Mar 7, 2026
• CVE-2026-30855 WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval.High 8.8 · Mar 7, 2026
• CVE-2025-63946 A privilege escalation (PE) vulnerability in the Tencent PC Manager app thru 17.10.28554.205 on Windows devices enables a local user to execute programs with elHigh 7.4 · Feb 23, 2026
• CVE-2025-63945 A privilege escalation (PE) vulnerability in the Tencent iOA app thru 210.9.28693.621001 on Windows devices enables a local user to execute programs with elevatHigh 7.4 · Feb 23, 2026
• CVE-2026-22688 WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval.Critical 9.9 · Jan 9, 2026
• CVE-2025-13716 Tencent MimicMotion create_pipeline Deserialization of Untrusted Data Remote Code Execution Vulnerability.High 7.8 · Dec 23, 2025
• CVE-2025-13715 Tencent FaceDetection-DSFD resnet Deserialization of Untrusted Data Remote Code Execution Vulnerability.High 7.8 · Dec 23, 2025
• CVE-2025-13714 Tencent MedicalNet generate_model Deserialization of Untrusted Data Remote Code Execution Vulnerability.High 7.8 · Dec 23, 2025
• CVE-2025-13713 Tencent Hunyuan3D-1 load_pretrained Deserialization of Untrusted Data Remote Code Execution Vulnerability.High 7.8 · Dec 23, 2025
• CVE-2025-13712 Tencent HunyuanDiT merge Deserialization of Untrusted Data Remote Code Execution Vulnerability.High 7.8 · Dec 23, 2025
• CVE-2025-13711 Tencent TFace eval Deserialization of Untrusted Data Remote Code Execution Vulnerability.High 7.8 · Dec 23, 2025
• CVE-2025-13710 Tencent HunyuanVideo load_vae Deserialization of Untrusted Data Remote Code Execution Vulnerability.High 7.8 · Dec 23, 2025
• CVE-2025-13709 Tencent TFace restore_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability.High 7.8 · Dec 23, 2025
• CVE-2025-13708 Tencent NeuralNLP-NeuralClassifier _load_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability.High 7.8 · Dec 23, 2025
• CVE-2025-13707 Tencent HunyuanDiT model_resume Deserialization of Untrusted Data Remote Code Execution Vulnerability.High 7.8 · Dec 23, 2025
• CVE-2025-13706 Tencent PatrickStar merge_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability.High 7.8 · Dec 23, 2025
• CVE-2025-56230 Tencent Docs Desktop 3.9.20 and earlier suffers from Missing SSL Certificate Validation in the update component.High 7.5 · Nov 4, 2025
• CVE-2024-40433 Insecure Permissions vulnerability in Tencent wechat v.8.0.37 allows an attacker to escalate privileges via the web-view component.High 8.8 · Jul 26, 2024
• CVE-2024-39684 Tencent RapidJSON is vulnerable to privilege escalation due to an integer overflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader.hHigh 7.8 · Jul 9, 2024