CVE-2026-84809Medium· 6.5▾ TwilightPoC availableTencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can dist…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 35.8 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 24.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.6%
Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding pycache directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside malicious compiled bytecode that executes on import while the scanner reports a safe verdict, enabling code execution when operators install the skill.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-101080Medium· 4.8A vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2
CVE-2026-116620High· 7.3Tencent RapidJSON Regex stream.h Take out-of-bounds
CVE-2026-112074Medium· 6.3Tencent ncnn Conversion API mat_pixel.cpp yuv420sp2rgb integer overflow
CVE-2026-112073Medium· 6.3Tencent ncnn MatMul matmul.cpp matmul_transb out-of-bounds
CVE-2026-108821Medium· 6.3A security vulnerability has been detected in Tencent WeKnora up to 0.8.1
CVE-2026-91750Medium· 6.5WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs