Tencent / WeKnora
13 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-91750 | WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects | HIGH | 7.1 | Sep 15, 2026 |
| CVE-2026-8786 | Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization | MEDIUM | 5.3 | May 18, 2026 |
| CVE-2026-30861 | WeKnora: Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation | CRITICAL | 10.0 | Mar 7, 2026 |
| CVE-2026-30860 | WeKnora: Remote Code Execution via SQL Injection Bypass in AI Database Query Tool | CRITICAL | 10.0 | Mar 7, 2026 |
| CVE-2026-30859 | WeKnora: Broken Access Control - Cross-Tenant Data Exposure | HIGH | 7.5 | Mar 7, 2026 |
| CVE-2026-30858 | WeKnora: DNS Rebinding Vulnerability in web_fetch Tool Allows SSRF to Internal Resources | HIGH | 7.5 | Mar 7, 2026 |
| CVE-2026-30857 | WeKnora: Unauthorized Cross‑Tenant Knowledge Base Cloning | MEDIUM | 5.9 | Mar 7, 2026 |
| CVE-2026-30856 | WeKnora: Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection | HIGH | 7.6 | Mar 7, 2026 |
| CVE-2026-30855 | WeKnora: Broken Access Control in Tenant Management | CRITICAL | 9.8 | Mar 7, 2026 |
| CVE-2026-30247 | WeKnora: SSRF via Redirection | HIGH | 7.5 | Mar 7, 2026 |
| CVE-2026-22688 | WeKnora has Command Injection in MCP stdio test | CRITICAL | 10.0 | Jan 10, 2026 |
| CVE-2026-22687 | WeKnora vulnerable to SQL Injection | CRITICAL | 9.8 | Jan 10, 2026 |
| CVE-2025-11046 | Tencent WeKnora test testEmbeddingModel server-side request forgery | MEDIUM | 6.9 | Sep 26, 2025 |
Showing 1 to 13 of 13 CVEs