Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-110211

SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint

iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion without ownership checks, purging all versions, files, reviews, ratings and metadata.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Iflytek
Products
Skillhub
CVE-2026-108550

SkillHub before 0.2.22 Account Takeover via Account Merge Flow

SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens, roles and namespace ownership.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Iflytek
Products
Skillhub