Vulnerabilities
Summary — last 7 days
New vulnerabilities5,032▲ 199 vs. last week
Critical / high2,142▼ 632 vs. last week
New active exploitation (KEV)9▼ 2 vs. last week
Unscored (no CVSS)773▲ 710 vs. last week
More filters
5 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Low (2.3) | 0.17% | — | Iflytek Astron AgentAI | 10/11/2026 | 10/18/2026 | iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflows by supplying their event_id to POST /workflow/v1/resume. Attackers can predict Snowflake event IDs to inject resume content into victim… | |
| Deferred | Critical (9.9) | 0.43% | — | Astron AgentAI | 10/9/2026 | 10/16/2026 | Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/code_node.py when CODE_EXEC_TYPE is not explicitly changed.… | |
| Deferred | Medium (5.3) | 0.30% | — | Iflytek Astron-agentAI | 9/23/2026 | 9/23/2026 | A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side request forgery. The attack can be initiated remotely. Upgrading… | |
| Deferred | Medium (5.3) | 0.23% | — | Iflytek Astron-agentAI | 9/23/2026 | 9/25/2026 | A weakness has been identified in iFlytek astron-agent up to 1.0.7. Affected is an unknown function of the file console/backend/commons/src/main/resources/mapper/ChatBotMarketMapper.xml of the component getBotList API endpoint. Executing a manipulation of the argument sortDirection can lead to sql injection. It is… | |
| Deferred | High (8.6) | 0.45% | — | Iflytek Astron-agentAI | 8/29/2026 | 9/10/2026 | iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows or copy private workflows to read their definitions. |