Tencent bug bounty programs
tencent.com Updated
Tencent runs two public programs: a YesWeHack bug bounty paying up to €5,000 and a self-hosted bug bounty.
- Top reward
- €5,000
- YesWeHack
- Programs
- 2
- 2 pay cash
- Targets in scope
- 7
- 2 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Tencent Bug Bounty Program
YesWeHack · Pays the most of the 2 programs: up to €5,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Tencent Bug Bounty Program
YesWeHack · Bug bounty |
€6,425 (highest) | €780 (highest) | €130 (highest) | €32 (highest) | €5,000 | – | – | – | Open |
|
Tencent Security Response Center
Self-hosted · Bug bounty |
– | – | – | – | Not published | – | – | – | Open |
-
- Critical
- €6,425 (highest)
- High
- €780 (highest)
- Medium
- €130 (highest)
- Low
- €32 (highest)
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
7 targets across all 2 programs, each listed once with the programs that cover it. 6 excluded.
-
Core Assets In-Scope Products (for the full list please visit https://en.security.tencent.com/index.php/policy)
Products and areas
Covered by YesWeHack
-
Non Core Assets In-Scope Products (for the full list please visit https://en.security.tencent.com/index.php/policy)
Products and areas
Covered by YesWeHack
No target matches. Try part of a host name, such as the company name.
Out of scope 6
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
*. myqcloud.com
YesWeHack
-
*.qzoneapp.com
YesWeHack
-
*Notes about Tencent Cloud (cloud.tencent.com as included in *.tencent.com)
YesWeHack
-
Only vulnerabilities affecting the platform itself and IP owned by Tencent will be accepted. If an IP belongs to Tencent Cloud external customer, it is not considered in scope.
YesWeHack
-
Please note that the vulnerabilities reported for the following assets will not be eligible for bounties.
YesWeHack
-
Third-party applications and websites
YesWeHack
Recent changes
Reward and scope changes across every Tencent program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Tencent products, from the NVD.
-
CVE-2026-8786 Low
A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/handler/initialization.go of the component Config API Endpoint. The manipulation of the argument kbId leads to authorization bypass. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
-
CVE-2026-8786 Low
A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/handler/initialization.go of the component Config API Endpoint. The manipulation of the argument kbId leads to authorization bypass. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
-
CVE-2026-5585 Medium
A vulnerability was found in Tencent AI-Infra-Guard 4.0. The affected element is an unknown function of the file common/websocket/task_manager.go of the component Task Detail Endpoint. Performing a manipulation results in information disclosure. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not
-
CVE-2026-5585 Medium
A vulnerability was found in Tencent AI-Infra-Guard 4.0. The affected element is an unknown function of the file common/websocket/task_manager.go of the component Task Detail Endpoint. Performing a manipulation results in information disclosure. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not
-
CVE-2026-30861 Critical
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. From version 0.2.5 to before version 0.2.10, an unauthenticated remote code execution (RCE) vulnerability exists in the MCP stdio configuration validation. The application allows unrestricted user registration, meaning any attacker can create an account and exploit the command injection flaw. Despi
-
CVE-2026-30858 Medium
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a DNS rebinding vulnerability in the web_fetch tool allows an unauthenticated attacker to bypass URL validation and access internal resources on the server, including private IP addresses (e.g., 127.0.0.1, 192.168.x.x). By crafting a malicious domain that resolves to a publi
-
CVE-2026-30858 Medium
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a DNS rebinding vulnerability in the web_fetch tool allows an unauthenticated attacker to bypass URL validation and access internal resources on the server, including private IP addresses (e.g., 127.0.0.1, 192.168.x.x). By crafting a malicious domain that resolves to a publi
-
CVE-2026-30859 Medium
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.12, a broken access control vulnerability in the database query tool allows any authenticated tenant to read sensitive data belonging to other tenants, including API keys, model configurations, and private messages. The application fails to enforce tenant isolation on critical
About this page
This page gathers every public program listed under tencent.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.