Skip to content
Noroxi

Tencent records

47 published records for vendor tencent.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
6
With a fix record
25.5%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 19
  3. 20
  4. 21
  5. 22
  6. 23
  7. 24
  8. 25
  9. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

Bug bounty scope

The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.

All records

47 records
  • CVE-2021-27439
    39Monitor

    TencentOS-tiny Integer Overflow or Wraparound

    CriticalCVSS 9.8No exploitEPSS 1%

    tencent · tencentos-tinyMay 3, 2022

  • CVE-2024-33078
    39Monitor

    Tencent Libpag v4.3 is vulnerable to Buffer Overflow.

    CriticalCVSS 9.8No exploitEPSS 1%

    tencent · libpagMay 1, 2024

  • CVE-2023-30363
    39Monitor

    vConsole v3.15.0 was discovered to contain a prototype pollution due to incorrect key and value resolution in setOptions in core.ts.

    CriticalCVSS 9.8No exploitEPSS 0%

    tencent · vconsoleApr 26, 2023

  • CVE-2026-30860
    39Monitor

    WeKnora: Remote Code Execution via SQL Injection Bypass in AI Database Query Tool

    CriticalCVSS 9.8No exploitEPSS 0%

    tencent · weknoraMar 7, 2026

  • CVE-2026-22687
    39Monitor

    WeKnora vulnerable to SQL Injection

    CriticalCVSS 9.8No exploitEPSS 0%

    tencent · weknoraJan 10, 2026

  • CVE-2018-11616
    36Monitor

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Tencent Foxmail 7.2.9.115.

    HighCVSS 8.8No exploitEPSS 4%

    tencent · foxmailAug 30, 2018

  • CVE-2026-30861
    36Monitor

    WeKnora: Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation

    HighCVSS 8.8No exploitEPSS 2%

    tencent · weknoraMar 7, 2026

  • CVE-2020-27874
    36Monitor

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent WeChat 7.0.18.

    HighCVSS 8.8No exploitEPSS 2%

    tencent · wechatFeb 10, 2021

  • CVE-2026-22688
    36Monitor

    WeKnora has Command Injection in MCP stdio test

    HighCVSS 8.8No exploitEPSS 1%

    tencent · weknoraJan 10, 2026

  • CVE-2024-40433
    35Monitor

    Insecure Permissions vulnerability in Tencent wechat v.8.0.37 allows an attacker to escalate privileges via the web-view component.

    HighCVSS 8.8No exploitEPSS 1%

    tencent · wechatJul 26, 2024

  • CVE-2026-30855
    35Monitor

    WeKnora: Broken Access Control in Tenant Management

    HighCVSS 8.8No exploitEPSS 0%

    tencent · weknoraMar 7, 2026

  • CVE-2021-33879
    32Monitor

    Tencent GameLoop before 4.1.21.90 downloaded updates over an insecure HTTP connection.

    HighCVSS 8.1Proof of conceptEPSS 1%

    tencent · gameloopJun 6, 2021

  • CVE-2024-22873
    32Monitor

    Tencent Blueking CMDB v3.2.x to v3.9.x was discovered to contain a Server-Side Request Forgery (SSRF) via the event subscription function (/

    HighCVSS 8.1No exploitEPSS 0%

    tencent · blueking configuration management databaseFeb 26, 2024

  • CVE-2018-13439
    31Monitor

    WXPayUtil in WeChat Pay Java SDK allows XXE attacks involving a merchant notification URL.

    HighCVSS 7.5No exploitEPSS 1%

    tencent · wechat payJul 8, 2018

  • CVE-2020-10551
    31Monitor

    QQBrowser before 10.5.3870.400 installs a Windows service TsService.exe.

    HighCVSS 7.8Proof of conceptEPSS 1%

    tencent · qqbrowserApr 9, 2020

  • CVE-2019-13125
    31Monitor

    HaboMalHunter through 2.0.0.3 in Tencent Habo allows attackers to evade dynamic malware analysis via PIE compilation.

    HighCVSS 7.8No exploitEPSS 0%

    tencent · habomalhunterJul 1, 2019

  • CVE-2023-34312
    31Monitor

    In Tencent QQ through 9.7.8.29039 and TIM through 3.4.7.22084, QQProtect.exe and QQProtectEngine.dll do not validate pointers from inter-pro

    HighCVSS 7.8Proof of conceptEPSS 0%

    tencent · qqMay 31, 2023

  • CVE-2025-13711
    31Monitor

    Tencent TFace eval Deserialization of Untrusted Data Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 0%

    tencent · tfaceDec 23, 2025

  • CVE-2025-13709
    31Monitor

    Tencent TFace restore_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 0%

    tencent · tfaceDec 23, 2025

  • CVE-2020-24160
    31Monitor

    Shenzhen Tencent TIM Windows client 3.0.0.21315 has a DLL hijacking vulnerability, which can be exploited by attackers to execute malicious

    HighCVSS 7.8No exploitEPSS 0%

    tencent · timSep 3, 2020

  • CVE-2024-39684
    31Monitor

    Tencent RapidJSON include/rapidjson/reader.h GenericReader::ParseNumber() Function Template Exponent Parsing Integer Overflow

    HighCVSS 7.8No exploitEPSS 0%

    tencent · rapidjsonJul 9, 2024

  • CVE-2020-24162
    31Monitor

    The Shenzhen Tencent app 5.8.2.5300 for PC platforms (from Tencent App Center) has a DLL hijacking vulnerability.

    HighCVSS 7.8No exploitEPSS 0%

    tencent · tencentSep 3, 2020

  • CVE-2021-40180
    30Monitor

    In the WeChat application 8.0.10 for Android and iOS, a mini program can obtain sensitive information from a user's address book via wx.sear

    HighCVSS 7.5No exploitEPSS 1%

    tencent · wechatJul 26, 2022

  • CVE-2021-33057
    30Monitor

    The QQ application 8.7.1 for Android and iOS does not enforce the permission requirements (e.g., android.permission.ACCESS_FINE_LOCATION) fo

    HighCVSS 7.5No exploitEPSS 1%

    tencent · qqJul 26, 2022

  • CVE-2022-35158
    30Monitor

    A vulnerability in the lua parser of TscanCode tsclua v2.15.01 allows attackers to cause a Denial of Service (DoS) via a crafted lua script.

    HighCVSS 7.5No exploitEPSS 0%

    tencent · tscancodeAug 3, 2022