CVE-2026-89040Critical· 9.8▾ MidnightTencent Mass Service Engine in Cluster (MSEC) allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device. An attacker who uploads a webshell can execute arbitrary code…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.9%
Last analysed / modified upstream
0.9% → 1.1%
Tencent Mass Service Engine in Cluster (MSEC) allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device. An attacker who uploads a webshell can execute arbitrary code as root.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-101080Medium· 4.8A vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2
CVE-2026-118376Medium· 5.3WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses
CVE-2026-116620High· 7.3Tencent RapidJSON Regex stream.h Take out-of-bounds
CVE-2026-112074Medium· 6.3Tencent ncnn Conversion API mat_pixel.cpp yuv420sp2rgb integer overflow
CVE-2026-112073Medium· 6.3Tencent ncnn MatMul matmul.cpp matmul_transb out-of-bounds
CVE-2026-108821Medium· 6.3A security vulnerability has been detected in Tencent WeKnora up to 0.8.1