IF
Vendor
iflytek
14
CVEs
0
On KEV
11
New 30D
Products
AS9.9
astron-agent
iflytek
7 CVEs0 on KEV4 new
AS7.5
astron-rpa
iflytek
5 CVEs0 on KEV5 new
SK8.8
skillhub
iflytek
2 CVEs0 on KEV2 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116340 New | AS astron-agent iFlytek | 4.3 | Oct 26 | iFlytek astron-agent Console Knowledge-List Endpoint FileInfoV2Service.java FileInfoV2Service.listKnowledgeByPage authorization |
| CVE-2026-116339 New | AS astron-agent iFlytek | 7.3 | Oct 26 | iFlytek astron-agent DDL Whitelist exec_ddl.py incomplete blacklist |
| CVE-2026-110764 | AS astron-rpa iflytek | 5.3 | Oct 14 | AstronRPA through 1.1.6 Cross-Tenant File Disclosure via /file/download |
| CVE-2026-110211 | SK skillhub iflytek | 8.1 | Oct 13 | SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint |
| CVE-2026-108864 | AS astron-agent iflytek | 4.2 | Oct 11 | iFlytek Astron Agent through 1.1.2 Authorization Bypass via /workflow/v1/resume Endpoint |
| CVE-2026-108550 | SK skillhub iflytek | 8.8 | Oct 10 | SkillHub before 0.2.22 Account Takeover via Account Merge Flow |
| CVE-2026-108548 | AS astron-rpa iflytek | 7.3 | Oct 10 | AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token |
| CVE-2026-108547 | AS astron-rpa iflytek | 6.5 | Oct 10 | AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-var |
| CVE-2026-108263 | AS astron-agent iflytek | 9.9 | Oct 9 | Astron Agent: Unsandboxed code-node leads to cross-tenant RCE |
| CVE-2026-108160 | AS astron-rpa iflytek | 7.5 | Oct 9 | AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed |
| CVE-2026-108159 | AS astron-rpa iflytek | 7.5 | Oct 9 | AstronRPA through 1.1.6 RCE via Smart-Component Chat XSS and IPC Bridge |
| CVE-2026-95930 | AS astron-agent iFlytek | 6.3 | Sep 23 | iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery |
| CVE-2026-95929 | AS astron-agent iFlytek | 6.3 | Sep 23 | iFlytek astron-agent getBotList API endpoint ChatBotMarketMapper.xml sql injection |
| CVE-2026-82475 | AS astron-agent iflytek | 8.1 | Aug 29 | iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check |