Tencent WeKnora vulnerabilities

14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.

Latest Tencent WeKnora vulnerabilities

CVE-2026-118376 — WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses (CVSS 5.3)
CVE-2026-108821 — Tencent WeKnora SQL Validator inject.go validateSubquery sql injection (CVSS 6.3)
CVE-2026-91750 — WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects (CVSS 6.5)
CVE-2026-8786 — Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization (CVSS 6.3)
CVE-2026-30861 — WeKnora: Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation (CVSS 8.8)
CVE-2026-30860 — WeKnora: Remote Code Execution via SQL Injection Bypass in AI Database Query Tool (CVSS 9.8)
CVE-2026-30859 — WeKnora: Broken Access Control - Cross-Tenant Data Exposure (CVSS 6.5)
CVE-2026-30858 — WeKnora: DNS Rebinding Vulnerability in web_fetch Tool Allows SSRF to Internal Resources (CVSS 7.5)
CVE-2026-30857 — WeKnora: Unauthorized Cross‑Tenant Knowledge Base Cloning (CVSS 5.3)
CVE-2026-30856 — WeKnora: Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection (CVSS 7.6)
CVE-2026-30855 — WeKnora: Broken Access Control in Tenant Management (CVSS 8.8)
CVE-2026-30247 — WeKnora: SSRF via Redirection (CVSS 7.5)
CVE-2026-22688 — WeKnora has Command Injection in MCP stdio test (CVSS 8.8)
CVE-2026-22687 — WeKnora vulnerable to SQL Injection (CVSS 9.8)
CVE-2025-11046 — Tencent WeKnora test testEmbeddingModel server-side request forgery (CVSS 9.8)