Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Tencent — Vulnerabilities & Security Advisories 38

Browse all 38 CVE security advisories affecting Tencent. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Tencent operates as a global technology conglomerate, primarily known for its social networking platforms, cloud services, and digital entertainment ecosystems. With twenty-nine recorded Common Vulnerabilities and Exposures (CVEs), the company’s historical security landscape reveals a pattern of typical enterprise software flaws. These incidents predominantly involve remote code execution, cross-site scripting, and privilege escalation vulnerabilities, often stemming from complex web applications and backend infrastructure components. While no single catastrophic breach has defined its public security narrative, the volume of disclosed issues highlights the challenges inherent in maintaining vast, interconnected digital services. The company’s security posture reflects standard industry risks associated with large-scale software development, where diverse product lines create multiple attack surfaces. Continuous patching and rigorous code review processes remain essential for mitigating these recurring technical defects across its extensive portfolio of consumer and enterprise tools.

CVE ID Title CVSS Severity Published
CVE-2026-101080 Tencent AI-Infra-Guard File Access dir_actions.py startsWith path traversal — AI-Infra-Guard CWE-22 4.8 Medium 2026-09-28
CVE-2026-94111 Tencent BrowserSkill through 0.3.0 Origin Validation Error in Local WebSocket Daemon — BrowserSkill CWE-346 6.6 Medium 2026-09-20
CVE-2026-89040 Tencent Mass Service Engine in Cluster (MSEC) path traversal — Mass Service Engine in Cluster (MSEC) CWE-22 9.8 Critical 2026-09-15
CVE-2026-91750 WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects — WeKnora CWE-918 6.5 Medium 2026-09-15
CVE-2026-84809 Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecode — AI-Infra-Guard CWE-693 6.5 Medium 2026-09-02
CVE-2026-72565 Tencent APIJSON - Unauthenticated SQL Injection via @having Operator Map-Form Bypass — APIJSON CWE-89 9.8 Critical 2026-08-10
CVE-2026-50144 ncnn: Out-of-bounds heap write in ParamDict::load_param via unchecked negative parameter id — ncnn CWE-20 7.1 High 2026-07-15
CVE-2026-15515 Tencent PC Manager QMUDisk Driver qmudisk64.sys uncontrolled search path — PC Manager CWE-427 7.0 High 2026-07-13
CVE-2026-8786 Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization — WeKnora CWE-639 6.3 Medium 2026-05-18
CVE-2026-5585 Tencent AI-Infra-Guard Task Detail Endpoint task_manager.go information disclosure — AI-Infra-Guard CWE-200 5.3 Medium 2026-04-05
CVE-2026-30861 WeKnora: Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation — WeKnora CWE-78 10.0 Critical 2026-03-07
CVE-2026-30860 WeKnora: Remote Code Execution via SQL Injection Bypass in AI Database Query Tool — WeKnora CWE-89 10.0 Critical 2026-03-07
CVE-2026-30859 WeKnora: Broken Access Control - Cross-Tenant Data Exposure — WeKnora CWE-284 5.3 Medium 2026-03-07
CVE-2026-30858 WeKnora: DNS Rebinding Vulnerability in web_fetch Tool Allows SSRF to Internal Resources — WeKnora CWE-918 6.5 Medium 2026-03-07
CVE-2026-30857 WeKnora: Unauthorized Cross‑Tenant Knowledge Base Cloning — WeKnora CWE-639 5.3 Medium 2026-03-07
CVE-2026-30856 WeKnora: Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection — WeKnora CWE-706 5.9 Medium 2026-03-07
CVE-2026-30855 WeKnora: Broken Access Control in Tenant Management — WeKnora CWE-284 8.8 High 2026-03-07
CVE-2026-30247 WeKnora: SSRF via Redirection — WeKnora CWE-918 5.9 Medium 2026-03-07
CVE-2026-22688 WeKnora has Command Injection in MCP stdio test — WeKnora CWE-77 10.0 Critical 2026-01-10
CVE-2026-22687 WeKnora vulnerable to SQL Injection — WeKnora CWE-89 5.6 Medium 2026-01-10
CVE-2025-13715 Tencent FaceDetection-DSFD resnet Deserialization of Untrusted Data Remote Code Execution Vulnerability — FaceDetection-DSFD CWE-502 7.8AI High AI 2025-12-23
CVE-2025-13709 Tencent TFace restore_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability — TFace CWE-502 7.8AI High AI 2025-12-23
CVE-2025-13711 Tencent TFace eval Deserialization of Untrusted Data Remote Code Execution Vulnerability — TFace CWE-502 7.8AI High AI 2025-12-23
CVE-2025-13706 Tencent PatrickStar merge_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability — PatrickStar CWE-502 7.8AI High AI 2025-12-23
CVE-2025-13708 Tencent NeuralNLP-NeuralClassifier _load_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability — NeuralNLP-NeuralClassifier CWE-502 7.8AI High AI 2025-12-23
CVE-2025-13716 Tencent MimicMotion create_pipeline Deserialization of Untrusted Data Remote Code Execution Vulnerability — MimicMotion CWE-502 7.8AI High AI 2025-12-23
CVE-2025-13714 Tencent MedicalNet generate_model Deserialization of Untrusted Data Remote Code Execution Vulnerability — MedicalNet CWE-502 7.8AI High AI 2025-12-23
CVE-2025-13710 Tencent HunyuanVideo load_vae Deserialization of Untrusted Data Remote Code Execution Vulnerability — HunyuanVideo CWE-502 7.8AI High AI 2025-12-23
CVE-2025-13707 Tencent HunyuanDiT model_resume Deserialization of Untrusted Data Remote Code Execution Vulnerability — HunyuanDiT CWE-502 7.8AI High AI 2025-12-23
CVE-2025-13712 Tencent HunyuanDiT merge Deserialization of Untrusted Data Remote Code Execution Vulnerability — HunyuanDiT CWE-502 7.8AI High AI 2025-12-23

This page lists every published CVE security advisory associated with Tencent. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.