Skip to content
OpenAdvisories

Package · Go

github.com/Tencent/WeKnora

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-30859

    WeKnora: Broken Access Control - Cross-Tenant Data Exposure

    WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.12, a broken access control vulnerability in the database query tool allows any authenticated tenant to read sensitive data belonging to …

    Tencent WeKnora github.com/Tencent/WeKnora Go
  • Medium 6.5
    CVE-2026-30858

    WeKnora: DNS Rebinding Vulnerability in web_fetch Tool Allows SSRF to Internal Resources

    WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a DNS rebinding vulnerability in the web_fetch tool allows an unauthenticated attacker to bypass URL validation and access internal re…

    Tencent WeKnora github.com/Tencent/WeKnora Go
  • Medium 5.3
    CVE-2026-30857

    WeKnora: Unauthorized Cross‑Tenant Knowledge Base Cloning

    WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a cross-tenant authorization bypass in the knowledge base copy endpoint allows any authenticated user to clone (duplicate) another ten…

    Tencent WeKnora github.com/Tencent/WeKnora Go
  • Medium 5.9
    CVE-2026-30856

    WeKnora: Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection

    WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a vulnerability involving tool name collision and indirect prompt injection allows a malicious remote MCP server to hijack tool execut…

    Tencent WeKnora github.com/Tencent/WeKnora Go
  • Medium 5.9
    CVE-2026-30247

    WeKnora: SSRF via Redirection

    WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.12, the application's "Import document via URL" feature is vulnerable to Server-Side Request Forgery (SSRF) through HTTP redirects. While…

    Tencent WeKnora github.com/Tencent/WeKnora Go
  • Medium 5.6
    CVE-2026-22687

    WeKnora vulnerable to SQL Injection

    WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.5, after WeKnora enables the Agent service, it allows users to call the database query tool. Due to insufficient backend validation, an a…

    Tencent WeKnora github.com/Tencent/WeKnora Go