I
Vendor security profile
iflytek
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs10
Critical1
CISA KEV0
Public exploit2
Patch rate%30
Avg. CVSS7.0
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
1
2
7
CVE KEV
CVE severity distribution
10toplam CVE
Critical1 (10%)
High5 (50%)
Medium3 (30%)
Low1 (10%)
Patch and exploitation view
%30
Verified patch
%0
CISA KEV
%20
Public exploit
3Patch available
0Partial
0Workaround
0Vendor: no patch
7Unknown
Latest vulnerabilities
2.3
CVE-2026-108864
iFlytek Astron Agent through 1.1.2 Authorization Bypass via /workflow/v1/resume Endpoint
I
Patch status unknown
8.7
CVE-2026-108550
SkillHub before 0.2.22 Account Takeover via Account Merge Flow
I
Patch verifiedEPSS %0
6.9
CVE-2026-108548
AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token
I
Patch status unknownEPSS %0
7.1
CVE-2026-108547
AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-var
I
Patch status unknownEPSS %0
9.9
CVE-2026-108263
Astron Agent: Unsandboxed code-node leads to cross-tenant RCE
I
Patch status unknownEPSS %0
7.7
CVE-2026-108160
AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed
I
Patch status unknownEPSS %0
7.7
CVE-2026-108159
AstronRPA through 1.1.6 RCE via Smart-Component Chat XSS and IPC Bridge
I
Patch status unknownEPSS %0
5.3
CVE-2026-95930
iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery
I
Patch verifiedEPSS %0
5.3
CVE-2026-95929
iFlytek astron-agent getBotList API endpoint ChatBotMarketMapper.xml sql injection
I
Patch verifiedEPSS %0
8.6
CVE-2026-82475
iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check
I
Patch status unknownEPSS %0