Tencent's vulnerability footprint spans a diverse portfolio of widely used consumer and enterprise applications including WeChat, QQ, and multimedia libraries, making it a prominent fixture in the landscape despite a focused product count. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated share reaching critical severity, though the exposure does not cluster heavily around confirmed in-the-wild exploitation or public exploit availability. The recurring weakness classes—including server-side request forgery, sensitive information disclosure, improper access control, and authorization bypass—reflect the authentication, data-handling, and integration demands of large-scale messaging and social platforms. Defenders should prioritize Tencent advisories for products present in their environments, particularly where user-facing or API-accessible endpoints are exposed; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Tencent over time
Signals from CVEs in this vendor scope (46 CVEs).
46 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-30860CRITICAL WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.12, a remote code execution (RCE) vulnerability exists in | Mar 7, 2026 | 9.8 | 34 | NO | NO |
CVE-2026-22688HIGH WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.5, there is a command injection vulnerability that allows | Jan 10, 2026 | 8.8 | 33 | NO | NO |
CVE-2026-22687CRITICAL WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.5, after WeKnora enables the Agent service, it allows user | Jan 10, 2026 | 9.8 | 32 | NO | NO |
CVE-2026-30861HIGH WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. From version 0.2.5 to before version 0.2.10, an unauthenticated remote code exe | Mar 7, 2026 | 8.8 | 31 | NO | NO |
CVE-2021-27439CRITICAL TencentOS-tiny version 3.1.0 is vulnerable to integer wrap-around in function 'tos_mmheap_alloc incorrect calculation of effective memory allocation size. This improper memory assi | May 3, 2022 | 9.8 | 31 | NO | NO |
CVE-2026-30856HIGH WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a vulnerability involving tool name collision and indi | Mar 7, 2026 | 7.6 | 30 | NO | NO |
CVE-2026-30855HIGH WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.2, an authorization bypass in tenant management endpoints | Mar 7, 2026 | 8.8 | 30 | NO | NO |
CVE-2025-11046CRITICAL A security flaw has been discovered in Tencent WeKnora 0.1.0. This impacts the function testEmbeddingModel of the file /api/v1/initialization/embedding/test. The manipulation of th | Sep 26, 2025 | 9.8 | 30 | NO | NO |
CVE-2019-11419MEDIUM vcodec2_hls_filter in libvoipCodec_v7a.so in the WeChat application through 7.0.3 for Android allows attackers to cause a denial of service (application crash) by replacing an emoj | May 14, 2019 | 5.5 | 30 | NO | YES |
CVE-2018-11616HIGH This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Tencent Foxmail 7.2.9.115. User interaction is required to exploit this vulnerab | Aug 30, 2018 | 8.8 | 30 | NO | NO |
Signals from CVEs in this vendor scope (46 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Tencent.
Media articles that mention a CVE ID that affects a product developed by Tencent — matched by CVE ID, not by vendor name.