CVE-2025-63946

A privilege escalation PE vulnerability in the Tencent PC Manager app thru 17.10.28554.205 on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race condition...

CVE-2025-63945

A privilege escalation PE vulnerability in the Tencent iOA app thru 210.9.28693.621001 on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race condition...

CVE-2025-63945

A privilege escalation PE vulnerability in the Tencent iOA app thru 210.9.28693.621001 on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race condition...

CVE-2025-63946

A privilege escalation PE vulnerability in the Tencent PC Manager app thru 17.10.28554.205 on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race condition...

CVE-2025-63945

A privilege escalation PE vulnerability in the Tencent iOA app thru 210.9.28693.621001 on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race condition...

PT-2026-21541

Name of the Vulnerable Software and Affected Versions Tencent iOA versions through 210.9.28693.621001 Description A privilege escalation issue exists in the Tencent iOA app on Windows devices. A local user can execute programs with elevated privileges by exploiting a race condition. Recommendatio...

CVE-2025-63946

A privilege escalation PE vulnerability in the Tencent PC Manager app thru 17.10.28554.205 on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race condition...

CVE-2025-63945

A privilege escalation PE vulnerability in the Tencent iOA app thru 210.9.28693.621001 on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race condition...

CVE-2025-63945

Tencent iOA versions through 210.9.28693.621001 on Windows devices are vulnerable to a privilege escalation (PE) flaw. The root cause is insecure handling of files and directories within C:\Windows\Temp by the LegacyKB_ioa_win.exe process. Because the TencentDownload directory can be created and ...

PT-2026-21542

Name of the Vulnerable Software and Affected Versions Tencent PC Manager versions through 17.10.28554.205 Description A privilege escalation issue exists in the Tencent PC Manager application on Windows devices. A local user can potentially execute programs with elevated privileges by exploiting ...

CVE-2025-63946

A privilege escalation vulnerability exists in Tencent PC Manager (versions through 17.10.28554.205 ) on Windows devices. The root cause is the insecure handling of files and directories under C:\Windows\Temp by the process QQPCRtp.exe, which runs with SYSTEM privileges. Specifically, the applica...

CVE-2025-63946: Improper Link Resolution Before File Access

A privilege escalation PE vulnerability in the Tencent PC Manager app thru 17.10.28554.205 on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race condition...

Tencent iOA 安全漏洞

Tencent iOA is a zero-trust, borderless office and terminal security management platform developed by Tencent Corporation in China. Versions of Tencent iOA starting from 210.9.28693.621001 and earlier contain security vulnerabilities. These vulnerabilities stem from local users being able to...

Tencent PC Manager 安全漏洞

Tencent PC Manager is a free computer security software developed by Tencent Corporation in China. It integrates antivirus protection, security safeguards, and system optimization functions. Versions of Tencent PC Manager prior to 17.10.28554.205 contained a security vulnerability. This...

CVE-2025-63945: Improper Link Resolution Before File Access

A privilege escalation PE vulnerability in the Tencent iOA app thru 210.9.28693.621001 on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race condition...

AnythingLLM security vulnerabilities

AnythingLLM is an integrated AI application developed by Mintplex. Versions of AnythingLLM prior to 1.10.0 contained a security vulnerability. This vulnerability stemmed from the /api/setup-complete endpoint exposing the QdrantApiKey in plain text, which could allow attackers to gain read/write...

GHSA-QV7W-V773-3XQM sm-crypto Affected by Signature Malleability in SM2-DSA

Summary A signature malleability vulnerability exists in the SM2 signature verification logic of the sm-crypto library. An attacker can derive a new valid signature for a previously signed message from an existing signature. Credit This vulnerability was discovered by: - XlabAI Team of Tencent...

GHSA-PGX9-497M-6C4V sm-crypto Affected by Private Key Recovery in SM2-PKE

Summary A private key recovery vulnerability exists in the SM2 decryption logic of sm-crypto. By interacting with the SM2 decryption interface multiple times, an attacker can fully recover the private key within approximately several hundred interactions. Credit This vulnerability was discovered...

PT-2026-3893

Name of the Vulnerable Software and Affected Versions sm-crypto versions prior to 0.3.14 Description sm-crypto, a JavaScript library providing implementations of Chinese cryptographic algorithms SM2, SM3, and SM4, contains a flaw in the SM2 decryption logic. An attacker can recover the private ke...

PT-2026-3894

Name of the Vulnerable Software and Affected Versions sm-crypto versions prior to 0.3.14 Description The sm-crypto library, providing JavaScript implementations of Chinese cryptographic algorithms SM2, SM3, and SM4, contains a signature malleability issue in its SM2 signature verification logic. ...