Flowiseai Flowise-components vulnerabilities

• flowiseai flowise, flowise-components +1 more Flowise RCE via TypeORM DataSource CVE-2026-69251 Fix available 9.0 CriticalAugust 4, 2026
• flowiseai flowise, flowise-components +1 more Flowise: Cypher Injection in GraphCypherQAChain CVE-2026-41274 Fix available 9.3 CriticalApril 16, 2026
• flowiseai flowise, flowise-components +1 more Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains CVE-2026-41271 Fix available 7.1 HighApril 16, 2026
• flowiseai flowise, flowise-components +1 more Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure) CVE-2026-41272 Fix available 7.1 HighApril 16, 2026
• flowiseai flowise, flowise-components +1 more Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox CVE-2026-41270 Fix available 7.1 HighApril 16, 2026
• flowiseai flowise, flowise-components +1 more Flowise: Code Injection in CSVAgent leads to Authenticated RCE CVE-2026-41137 Fix available 9.4 CriticalApril 16, 2026
• flowiseai flowise, flowise-components +1 more Flowise: Authenticated RCE Via MCP Adapters CVE-2026-40933 Fix available EPSS 12.0% 10.0 CriticalApril 16, 2026