IiFlytek

Products

Exploited and recent CVEs

• CVE-2026-116340 Medium 4.3 iFlytek astron-agent Console Knowledge-List Endpoint FileInfoV2Service.java FileInfoV2Service.listKnowledgeByPage authorization 0.3%
• CVE-2026-116339 High 7.3 iFlytek astron-agent DDL Whitelist exec_ddl.py incomplete blacklist 0.5%
• CVE-2026-110764 Medium 5.3 AstronRPA through 1.1.6 Cross-Tenant File Disclosure via /file/download 0.2%
• CVE-2026-110211 High 8.1 SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint 0.4%
• CVE-2026-108864 Medium 4.2 iFlytek Astron Agent through 1.1.2 Authorization Bypass via /workflow/v1/resume Endpoint 0.2%
• CVE-2026-108550 High 8.8 SkillHub before 0.2.22 Account Takeover via Account Merge Flow 0.3%
• CVE-2026-108548 High 7.3 AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token 0.3%
• CVE-2026-108547 Medium 6.5 AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-var 0.2%
• CVE-2026-108263 Critical 9.9 Astron Agent: Unsandboxed code-node leads to cross-tenant RCE 0.4%
• CVE-2026-108160 High 7.5 AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed 0.1%
• CVE-2026-108159 High 7.5 AstronRPA through 1.1.6 RCE via Smart-Component Chat XSS and IPC Bridge 0.3%
• CVE-2026-95930 Medium 6.3 iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery 0.4%
• CVE-2026-95929 Medium 6.3 iFlytek astron-agent getBotList API endpoint ChatBotMarketMapper.xml sql injection 0.4%
• CVE-2026-82475 High 8.1 iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check 0.4%