Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

14 records

Vendor: iflytek Clear all filters
TI-2026-74423 CVE-2026-110764

Cross-tenant file disclosure in iFlytek AstronRPA

Priority MEDIUM 60

AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows authenticated users to download other tenants' files by supplying their fileI…

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00237 Published 2026-10-14 No fix listed CWE-639
TI-2026-73428 CVE-2026-110211 · GHSA-p68j-4998-6884

iFlytek SkillHub Missing Authorization in CLI Skill Delete Endpoint

Priority LOW 32

iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00427 Published 2026-10-13 No fix listed CWE-862
TI-2026-70754 CVE-2026-108864 · GHSA-whrv-p3hh-8mvr

iFlytek Astron Agent Authorization Bypass via /workflow/v1/resume Endpoint

Priority LOW 11

iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflows by supplying their event_id to POST /wor…

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00169 Published 2026-10-11 No fix listed CWE-639
TI-2026-70549 CVE-2026-108550 · GHSA-wq7r-c6mg-rqv2

Account takeover via account merge flow in iFlytek SkillHub

Priority LOW 39

SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00302 Published 2026-10-10 Fixed in 0.2.22 CWE-863
TI-2026-70547 CVE-2026-108548 · GHSA-fh8f-pxvw-9f29

Authentication bypass in AstronRPA accepts arbitrary Bearer tokens

Priority LOW 36

AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00293 Published 2026-10-10 No fix listed CWE-287
TI-2026-70546 CVE-2026-108547 · GHSA-mcqv-c7v8-6mw4

AstronRPA Cross-Tenant Shared Variable Disclosure via get-batch-shared-var

Priority LOW 31

AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00238 Published 2026-10-10 No fix listed CWE-639
TI-2026-70103 CVE-2026-108160

Unsigned update installation in iflytek AstronRPA desktop client

Priority LOW 35

AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00147 Published 2026-10-09 No fix listed CWE-494
TI-2026-70102 CVE-2026-108159

Cross-site scripting in AstronRPA chat leads to command execution

Priority LOW 36

AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by abusing unsanitized LLM output rendered via v-html…

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.0033 Published 2026-10-09 No fix listed CWE-79