# Tencent vulnerabilities Source: https://junglewise.ai/threats/vendors/tencent Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/tencent.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 20 vulnerabilities in Tencent: 2 in the last 7 days and 13 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-125361, was published on 10 November 2026. 6 vulnerabilities in the last four weeks, up 50% on the four before (4). 0 critical against 1. 3 technologies have a page of their own. ## Counts - Last 7 days: 2 - Last 30 days: 7 - Last 90 days: 13 - All time: 20 (2 critical, 0 exploited in the wild) ## About Tencent A multinational technology conglomerate that provides internet-related services and products. ## Latest Tencent vulnerabilities - [CVE-2026-125361: Tencent BrowserSkill authentication bypass in daemon socket](https://junglewise.ai/threats/cve-2026-125361-tencent-browserskill-through-0-4-2-contains-a-missing) (medium, CVSS 6.3, published 10 Nov 2026) - [CVE-2026-124586: Tencent RapidJSON out-of-bounds read in floating-point parsing](https://junglewise.ai/threats/cve-2026-124586-a-vulnerability-was-determined-in-tencent-rapidjson-1-1-0) (high, CVSS 7.3, published 9 Nov 2026) - [CVE-2026-119648: Tencent BlueKing CMDB missing authorization vulnerability](https://junglewise.ai/threats/cve-2026-119648-tencent-blueking-cmdb-bk-cmdb-through-3-14-6-contains-a-missing) (medium, CVSS 4.3, published 30 Oct 2026) - [CVE-2026-118376: WeKnora server-side request forgery in isRestrictedIP()](https://junglewise.ai/threats/cve-2026-118376-weknora-before-0-8-2-contains-a-server-side-request-forgery) (medium, CVSS 5.3, published 28 Oct 2026) - [CVE-2026-116620: Tencent RapidJSON out-of-bounds read in string stream parsing](https://junglewise.ai/threats/cve-2026-116620-a-security-vulnerability-has-been-detected-in-tencent-rapidjson) (high, CVSS 7.3, published 27 Oct 2026) - [CVE-2026-112074: Tencent ncnn integer overflow in yuv420sp2rgb](https://junglewise.ai/threats/cve-2026-112074-a-security-flaw-has-been-discovered-in-tencent-ncnn-up-to) (medium, CVSS 6.3, published 19 Oct 2026) - [CVE-2026-112073: Tencent ncnn MatMul out-of-bounds read](https://junglewise.ai/threats/cve-2026-112073-a-vulnerability-was-identified-in-tencent-ncnn-up-to) (medium, CVSS 6.3, published 19 Oct 2026) - [CVE-2026-108821: Tencent WeKnora SQL injection in validateSubquery](https://junglewise.ai/threats/cve-2026-108821-a-security-vulnerability-has-been-detected-in-tencent-weknora-up) (medium, CVSS 6.3, published 12 Oct 2026) - [CVE-2026-101080: Tencent AI-Infra-Guard path traversal in file access](https://junglewise.ai/threats/cve-2026-101080-a-vulnerability-was-identified-in-tencent-ai-infra-guard-up-to-4) (medium, CVSS 4.8, published 28 Sep 2026) - [CVE-2026-94111: Tencent BrowserSkill authentication bypass in WebSocket origin validation](https://junglewise.ai/threats/cve-2026-94111-tencent-browserskill-through-0-3-0-contains-an-authentication) (medium, CVSS 6.6, published 20 Sep 2026) - [CVE-2026-89040: Tencent MSEC path traversal to remote code execution](https://junglewise.ai/threats/cve-2026-89040-tencent-msec-path-traversal-to-remote-code-execution) (critical, CVSS 9.8, published 15 Sep 2026) - [CVE-2026-91750: Tencent WeKnora SSRF via unvalidated HTTP redirects](https://junglewise.ai/threats/cve-2026-91750-tencent-weknora-ssrf-via-unvalidated-http-redirects) (medium, CVSS 6.5, published 15 Sep 2026) - [CVE-2026-84809: Tencent AI-Infra-Guard skill-scan bytecode bypass via __pycache__ exclusion](https://junglewise.ai/threats/cve-2026-84809-tencent-ai-infra-guard-skill-scan-bytecode-bypass-via-pycache) (medium, CVSS 6.5, published 2 Sep 2026) - [CVE-2026-72565: Tencent APIJSON SQL injection in @having operator](https://junglewise.ai/threats/cve-2026-72565-tencent-apijson-sql-injection-in-having-operator) (critical, CVSS 9.8, published 10 Aug 2026) - [CVE-2026-50144: Tencent ncnn heap out-of-bounds write in ParamDict::load_param](https://junglewise.ai/threats/cve-2026-50144-tencent-ncnn-heap-out-of-bounds-write-in-paramdict-load-param) (high, CVSS 7.1, published 15 Jul 2026) - [CVE-2026-8786: Tencent WeKnora authorization bypass in Config API Endpoint](https://junglewise.ai/threats/cve-2026-8786-tencent-weknora-authorization-bypass-in-config-api-endpoint) (medium, CVSS 6.3, published 18 May 2026) - [CVE-2026-7221: TencentCloudBase CloudBase-MCP SSRF in open-url API Endpoint](https://junglewise.ai/threats/cve-2026-7221-tencentcloudbase-cloudbase-mcp-ssrf-in-open-url-api-endpoint) (high, CVSS 7.3, published 28 Apr 2026) - [CVE-2026-5585: Tencent AI-Infra-Guard information disclosure in Task Detail Endpoint](https://junglewise.ai/threats/cve-2026-5585-tencent-ai-infra-guard-information-disclosure-in-task-detail) (medium, CVSS 5.3, published 5 Apr 2026) - [CVE-2025-13711: Tencent TFace eval Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows…](https://junglewise.ai/threats/cve-2025-13711-tencent-tface-eval-deserialization-of-untrusted-data-remote-code) (high, CVSS 7.8, published 23 Dec 2025) - [CVE-2025-13709: Tencent TFace restore_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This…](https://junglewise.ai/threats/cve-2025-13709-tencent-tface-restore-checkpoint-deserialization-of-untrusted) (high, CVSS 7.8, published 23 Dec 2025) ## Most severe Tencent vulnerabilities - [CVE-2026-89040: Tencent MSEC path traversal to remote code execution](https://junglewise.ai/threats/cve-2026-89040-tencent-msec-path-traversal-to-remote-code-execution) (critical, CVSS 9.8, published 15 Sep 2026) - [CVE-2026-72565: Tencent APIJSON SQL injection in @having operator](https://junglewise.ai/threats/cve-2026-72565-tencent-apijson-sql-injection-in-having-operator) (critical, CVSS 9.8, published 10 Aug 2026) - [CVE-2025-13711: Tencent TFace eval Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows…](https://junglewise.ai/threats/cve-2025-13711-tencent-tface-eval-deserialization-of-untrusted-data-remote-code) (high, CVSS 7.8, published 23 Dec 2025) - [CVE-2025-13709: Tencent TFace restore_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This…](https://junglewise.ai/threats/cve-2025-13709-tencent-tface-restore-checkpoint-deserialization-of-untrusted) (high, CVSS 7.8, published 23 Dec 2025) - [CVE-2026-7221: TencentCloudBase CloudBase-MCP SSRF in open-url API Endpoint](https://junglewise.ai/threats/cve-2026-7221-tencentcloudbase-cloudbase-mcp-ssrf-in-open-url-api-endpoint) (high, CVSS 7.3, published 28 Apr 2026) - [CVE-2026-124586: Tencent RapidJSON out-of-bounds read in floating-point parsing](https://junglewise.ai/threats/cve-2026-124586-a-vulnerability-was-determined-in-tencent-rapidjson-1-1-0) (high, CVSS 7.3, published 9 Nov 2026) - [CVE-2026-116620: Tencent RapidJSON out-of-bounds read in string stream parsing](https://junglewise.ai/threats/cve-2026-116620-a-security-vulnerability-has-been-detected-in-tencent-rapidjson) (high, CVSS 7.3, published 27 Oct 2026) - [CVE-2026-50144: Tencent ncnn heap out-of-bounds write in ParamDict::load_param](https://junglewise.ai/threats/cve-2026-50144-tencent-ncnn-heap-out-of-bounds-write-in-paramdict-load-param) (high, CVSS 7.1, published 15 Jul 2026) - [CVE-2026-94111: Tencent BrowserSkill authentication bypass in WebSocket origin validation](https://junglewise.ai/threats/cve-2026-94111-tencent-browserskill-through-0-3-0-contains-an-authentication) (medium, CVSS 6.6, published 20 Sep 2026) - [CVE-2026-84809: Tencent AI-Infra-Guard skill-scan bytecode bypass via __pycache__ exclusion](https://junglewise.ai/threats/cve-2026-84809-tencent-ai-infra-guard-skill-scan-bytecode-bypass-via-pycache) (medium, CVSS 6.5, published 2 Sep 2026) ## Vulnerabilities per week 6 vulnerabilities in the last four weeks, up 50% on the four before (4). 0 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 1 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 3 | 1 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 2 | 0 | 0 | | 26 Oct 2026 | 3 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 2 | 0 | 0 | ## Tencent technologies - [Tencent Weknora](https://junglewise.ai/threats/technologies/weknora): 4 vulnerabilities - [Tencent AI-Infra-Guard](https://junglewise.ai/threats/technologies/ai-infra-guard): 3 vulnerabilities - [Tencent Ncnn](https://junglewise.ai/threats/technologies/ncnn): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Tencent vulnerabilities", https://junglewise.ai/threats/vendors/tencent, 12 November 2026.