Tencent

35 CVEs across 41 Tencent products. Browse Tencent vulnerabilities, severities, and proof-of-concept exploits.

Tencent products with known CVEs

ProductCVEs
Weknora12
Wechat6
Hunyuandit2
Libpag2
Qq2
Rapidjson2
Tface2
Tim2
Ai-Infra-Guard1
Apijson1
Blueking Configuration Management Database1
Docs1
Enterprise Wechat Privatization1
Facedetection-Dsfd1
Foxmail1
Gameloop1
Habomalhunter1
Hunyuan3d-11
Hunyuanvideo1
Ioa1
Medicalnet1
Microblogpad1
Mimicmotion1
Mobileqq1
Ncnn1
Neuralnlp-Neuralclassifier1
Patrickstar1
Pc Manager1
Pcmanager1
Qqbrowser1
Qqpimsecure1
Qqpphoto1
Tencent1
Tencent Distributed Sql1
Tencent Foxmail1
Tencentos-Tiny1
Tscancode1
Vconsole1
Wblog1
Wechat Pay1
Wxsync1
Tencent CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-72565Critical9.82026-08-10A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary da…
CVE-2026-50144High7.12026-07-15ncnn is a high-performance neural network inference framework optimized for the mobile platform. In commit e54f7b1f88434e1d844ea0551b880a1cfb079ce1 and earlier…
CVE-2026-15515High7.02026-07-13A security vulnerability has been detected in Tencent PC Manager 18.1.30242.301. This issue affects some unknown processing in the library qmudisk64.sys of the…
CVE-2026-8786Medium6.32026-05-18A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/ha…
CVE-2026-5585Medium5.32026-04-05A vulnerability was found in Tencent AI-Infra-Guard 4.0. The affected element is an unknown function of the file common/websocket/task_manager.go of the compon…
CVE-2026-30861Critical9.92026-03-07WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. From version 0.2.5 to before version 0.2.10, an unauthenti…
CVE-2026-30860Critical9.92026-03-07WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.12, a remote code execution (RCE) vul…
CVE-2026-30859Medium5.32026-03-07WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.12, a broken access control vulnerabi…
CVE-2026-30858Medium6.52026-03-07WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a DNS rebinding vulnerability in t…
CVE-2026-30857Medium5.32026-03-07WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a cross-tenant authorization bypas…
CVE-2026-30856Medium5.92026-03-07WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a vulnerability involving tool na…
CVE-2026-30855High8.82026-03-07WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.2, an authorization bypass in tenant…
CVE-2026-30247Medium5.92026-03-07WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.12, the application's "Import documen…
CVE-2025-63946High7.42026-02-23A privilege escalation (PE) vulnerability in the Tencent PC Manager app thru 17.10.28554.205 on Windows devices enables a local user to execute programs with e…
CVE-2025-63945High7.42026-02-23A privilege escalation (PE) vulnerability in the Tencent iOA app thru 210.9.28693.621001 on Windows devices enables a local user to execute programs with eleva…
CVE-2026-22688Critical9.92026-01-10WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.5, there is a command injection vulne…
CVE-2026-22687Medium5.62026-01-10WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.5, after WeKnora enables the Agent se…
CVE-2025-13716High7.82025-12-23Tencent MimicMotion create_pipeline Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut…
CVE-2025-13715High7.82025-12-23Tencent FaceDetection-DSFD resnet Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute…
CVE-2025-13714High7.82025-12-23Tencent MedicalNet generate_model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute…
CVE-2025-13713High7.82025-12-23Tencent Hunyuan3D-1 load_pretrained Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut…
CVE-2025-13712High7.82025-12-23Tencent HunyuanDiT merge Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary…
CVE-2025-13711High7.82025-12-23Tencent TFace eval Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code…
CVE-2025-13710High7.82025-12-23Tencent HunyuanVideo load_vae Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbi…
CVE-2025-13709High7.82025-12-23Tencent TFace restore_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute a…
CVE-2025-13708High7.82025-12-23Tencent NeuralNLP-NeuralClassifier _load_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote att…
CVE-2025-13707High7.82025-12-23Tencent HunyuanDiT model_resume Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute ar…
CVE-2025-13706High7.82025-12-23Tencent PatrickStar merge_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execu…
CVE-2025-56230High7.52025-11-04Tencent Docs Desktop 3.9.20 and earlier suffers from Missing SSL Certificate Validation in the update component.
CVE-2025-11046High7.32025-09-26A security flaw has been discovered in Tencent WeKnora 0.1.0. This impacts the function testEmbeddingModel of the file /api/v1/initialization/embedding/test. T…
CVE-2024-40433High8.82024-07-26Insecure Permissions vulnerability in Tencent wechat v.8.0.37 allows an attacker to escalate privileges via the web-view component.
CVE-2024-39684High7.82024-07-09Tencent RapidJSON is vulnerable to privilege escalation due to an integer overflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader…
CVE-2024-38517High7.82024-07-09Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader…
CVE-2024-34408Medium5.32024-05-03Tencent libpag through 4.3.51 has an integer overflow in DecodeStream::checkEndOfFile() in codec/utils/DecodeStream.cpp via a crafted PAG (Portable Animated Gr…
CVE-2024-33078Critical9.82024-05-01Tencent Libpag v4.3 is vulnerable to Buffer Overflow. A user can send a crafted image to trigger a overflow leading to remote code execution.
CVE-2024-22873High8.12024-02-26Tencent Blueking CMDB v3.2.x to v3.9.x was discovered to contain a Server-Side Request Forgery (SSRF) via the event subscription function (/service/subscriptio…
CVE-2023-52286High7.52023-12-31Tencent tdsqlpcloud through 1.8.5 allows unauthenticated remote attackers to discover database credentials via an index.php/api/install/get_db_info request, a…
CVE-2023-40829High7.52023-10-12There is an interface unauthorized access vulnerability in the background of Tencent Enterprise Wechat Privatization 2.5.x and 2.6.930000.
CVE-2023-39988Medium6.52023-09-04Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in 标准云(std.Cloud) WxSync plugin <= 2.7.23 versions.
CVE-2023-34312High7.82023-06-01In Tencent QQ through 9.7.8.29039 and TIM through 3.4.7.22084, QQProtect.exe and QQProtectEngine.dll do not validate pointers from inter-process communication…
CVE-2023-30363Critical9.82023-04-26vConsole v3.15.0 was discovered to contain a prototype pollution due to incorrect key and value resolution in setOptions in core.ts.
CVE-2022-35158High7.52022-08-03A vulnerability in the lua parser of TscanCode tsclua v2.15.01 allows attackers to cause a Denial of Service (DoS) via a crafted lua script.
CVE-2021-40180High7.52022-07-26In the WeChat application 8.0.10 for Android and iOS, a mini program can obtain sensitive information from a user's address book via wx.searchContacts.
CVE-2021-33057High7.52022-07-26The QQ application 8.7.1 for Android and iOS does not enforce the permission requirements (e.g., android.permission.ACCESS_FINE_LOCATION) for determining the d…
CVE-2021-27439High7.32022-05-03TencentOS-tiny version 3.1.0 is vulnerable to integer wrap-around in function 'tos_mmheap_alloc incorrect calculation of effective memory allocation size. This…
CVE-2021-33879High8.12021-06-06Tencent GameLoop before 4.1.21.90 downloaded updates over an insecure HTTP connection. A malicious attacker in an MITM position could spoof the contents of an…
CVE-2021-27247Medium6.52021-04-14This vulnerability allows remote attackers to disclose sensitive information on affected installations of Tencent WeChat 2.9.5 desktop version. User interactio…
CVE-2020-27874High8.82021-02-10This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent WeChat 7.0.18. User interaction is required to exploi…
CVE-2020-24162High7.82020-09-03The Shenzhen Tencent app 5.8.2.5300 for PC platforms (from Tencent App Center) has a DLL hijacking vulnerability. Attackers can use this vulnerability to execu…
CVE-2020-24160High7.82020-09-03Shenzhen Tencent TIM Windows client 3.0.0.21315 has a DLL hijacking vulnerability, which can be exploited by attackers to execute malicious code.
CVE-2020-10551High7.82020-04-09QQBrowser before 10.5.3870.400 installs a Windows service TsService.exe. This file is writable by anyone belonging to the NT AUTHORITY\Authenticated Users grou…
CVE-2019-17151Medium5.42020-01-07This vulnerability allows remote attackers redirect users to an external resource on affected installations of Tencent WeChat Prior to 7.0.9. User interaction…
CVE-2019-13125High7.82019-07-01HaboMalHunter through 2.0.0.3 in Tencent Habo allows attackers to evade dynamic malware analysis via PIE compilation.
CVE-2019-11419Medium5.52019-05-14vcodec2_hls_filter in libvoipCodec_v7a.so in the WeChat application through 7.0.3 for Android allows attackers to cause a denial of service (application crash)…
CVE-2018-11616High8.82018-08-30This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Tencent Foxmail 7.2.9.115. User interaction is required to…
CVE-2018-13439High7.52018-07-08WXPayUtil in WeChat Pay Java SDK allows XXE attacks involving a merchant notification URL.
CVE-2011-48672012-01-25The Tencent QQPhoto (com.tencent.qqphoto) application 0.97 for Android does not properly protect data, which allows remote attackers to read or modify contact…
CVE-2011-48652012-01-25The Tencent WBlog (com.tencent.WBlog) 3.3.1 and MicroBlogPad 1.4.0 applications for Android do not properly protect data, which allows remote attackers to read…
CVE-2011-48642012-01-25The Tencent MobileQQ (com.tencent.mobileqq) application 2.2 for Android does not properly protect data, which allows remote attackers to read or modify message…
CVE-2011-48632012-01-25The Tencent QQPimSecure (com.tencent.qqpimsecure) application 3.0.2 for Android does not properly protect data, which allows remote attackers to read or modify…