Vulnerabilities

Filters

2 selected

12 records

Sort

Vendor: Tencent Component: Weknora Clear all filters

TI-2026-07724 CVE-2026-8786 · GHSA-4cvj-xf75-4wv6

Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization

MEDIUM 57

A vulnerability has been found in Tencent WeKnora up to 0.3.6.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00269 Published 2026-05-18 No fix listed CWE-285

TI-2026-23690 CVE-2026-30861 · GHSA-r55h-3rwj-hcmg

WeKnora: Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation

HIGH 76

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.02378 Published 2026-03-07 Fixed in 0.2.10 CWE-78

TI-2026-23689 CVE-2026-30860 · GHSA-8w32-6mrw-q5wv

WeKnora: Remote Code Execution via SQL Injection Bypass in AI Database Query Tool

HIGH 76

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00735 Published 2026-03-07 Fixed in 0.2.12 CWE-89

TI-2026-23688 CVE-2026-30859 · GHSA-2f4c-vrjq-rcgv

WeKnora: Broken Access Control - Cross-Tenant Data Exposure

MEDIUM 62

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00242 Published 2026-03-07 Fixed in 0.2.12 CWE-284

TI-2026-23687 CVE-2026-30858 · GHSA-h6gw-8f77-mmmp

WeKnora: DNS Rebinding Vulnerability in web_fetch Tool Allows SSRF to Internal Resources

HIGH 66

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00407 Published 2026-03-07 Fixed in 0.3.0 CWE-918

TI-2026-23686 CVE-2026-30857 · GHSA-8rf9-c59g-f82f

WeKnora: Unauthorized Cross‑Tenant Knowledge Base Cloning

MEDIUM 57

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00255 Published 2026-03-07 Fixed in 0.3.0 CWE-639

TI-2026-23685 CVE-2026-30856 · GHSA-67q9-58vj-32qx

WeKnora: Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection

HIGH 66

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval.

CVSS 3.1HIGH 7.6 Network No auth User interaction EPSS 0.0029 Published 2026-03-07 Fixed in 0.3.0 CWE-706

TI-2026-23684 CVE-2026-30855 · GHSA-ccj6-79j6-cq5q

WeKnora: Broken Access Control in Tenant Management

HIGH 73

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00377 Published 2026-03-07 Fixed in 0.3.2 CWE-284

TI-2026-23478 CVE-2026-30247 · GHSA-595m-wc8g-6qgc

WeKnora: SSRF via Redirection

HIGH 66

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00428 Published 2026-03-07 Fixed in 0.2.12 CWE-918

TI-2026-18215 CVE-2026-22688 · GHSA-78h3-63c4-5fqc

WeKnora has Command Injection in MCP stdio test

HIGH 76

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.01936 Published 2026-01-10 Fixed in 0.2.5 CWE-77

TI-2026-18214 CVE-2026-22687 · GHSA-pcwc-3fw3-8cqv

WeKnora vulnerable to SQL Injection

HIGH 75

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00383 Published 2026-01-10 Fixed in 0.2.5 CWE-89

TI-2025-10116 CVE-2025-11046 · GHSA-h2wr-wxxv-x8p9

Tencent WeKnora test testEmbeddingModel server-side request forgery

HIGH 70

A security flaw has been discovered in Tencent WeKnora 0.1.0.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00473 Published 2025-09-26 No fix listed CWE-918