Skip to contentFlowiseai Flowise vulnerabilities
- flowiseFlowise - Server-Side Request Forgery via Execute Flow Base URLCVE-2026-56275Fix available6.0 Medium
- flowiseai flowiseFlowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)CVE-2026-43995Fix available5.3 Medium
- flowiseFlowise - Path Traversal in Vector Store basePath ParameterCVE-2026-56273Fix available4.9 Medium
- flowiseFlowise - Weak Default Token Hash Secret in JWT Token EncryptionCVE-2026-56269Fix available4.3 Medium
- flowiseFlowise - Session Hijacking via Weak Default Express Session SecretCVE-2026-56278Fix available9.3 Critical
- flowiseFlowise - Weak Default JWT Secrets in Authentication MiddlewareCVE-2026-56271Fix available9.3 Critical
- flowiseFlowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod EndpointCVE-2026-56270Fix available8.7 High
- flowiseai flowise, flowise-components +1 moreFlowise: Authenticated RCE Via MCP AdaptersCVE-2026-40933Fix availableEPSS 12.0%10.0 Critical
- flowiseai flowiseFlowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network AccessCVE-2026-31829Fix available7.1 High
- flowiseai flowiseFlowise: Missing Authentication on NVIDIA NIM EndpointsCVE-2026-30824Public exploitFix availableEPSS 37.3%7.7 High
- flowiseai flowiseFlowise: IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO ConfigurationCVE-2026-30823Fix available8.8 High
- flowiseai flowiseFlowise: Mass Assignment in `/api/v1/leads` EndpointCVE-2026-30822Fix availableEPSS 15.0%7.7 High
- flowiseai flowiseFlowise: Arbitrary File Upload via MIME SpoofingCVE-2026-30821Fix availableEPSS 16.7%8.2 High
- flowiseai flowiseFlowise Authorization Bypass via Spoofed x-request-from HeaderCVE-2026-30820Fix available8.7 High
- flowiseFlowise - PII Disclosure via Unauthenticated Forgot Password EndpointCVE-2026-56267Fix available6.9 Medium
- flowiseFlowise - Insufficient Password Salt Rounds in Bcrypt HashingCVE-2026-56272Fix available5.6 Medium
- flowiseFlowise - Authentication Bypass via Unprotected Registration EndpointCVE-2025-713279.3 Critical
- flowiseFlowise - Unverified Password Change via Account SettingsCVE-2025-71328Fix available8.7 High
- flowiseFlowise - Unverified Email Change via Account Profile EndpointCVE-2025-71337Fix available8.7 High
- flowiseFlowise - Session Invalidation Failure After Password ChangeCVE-2025-71335Fix available8.6 High
- flowiseai flowiseFlowise Authenticated Command Execution and Sandbox Bypass via Puppeteer & Playwright PackagesCVE-2025-34267Fix available8.4 High
- flowiseai flowiseFlowise is vulnerable to arbitrary file read, arbitrary file writeCVE-2025-61913Fix availableEPSS 13.9%10.0 Critical
- flowiseai flowiseFlowiseAI/Flosise has File Upload vulnerabilityCVE-2025-61687Fix availableEPSS 12.7%8.3 High
- flowiseai flowiseFlowise Stored XSS vulnerability through logs in chatbotCVE-2025-29192Fix available8.2 High
- flowiseai flowiseDuplicate Advisory: Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panelCVE-2025-50538Fix availableEPSS 15.9%8.2 High
- flowiseFlowise - Cross-Site Scripting in Chat Messages and Agent WorkflowsCVE-2025-71331Fix available5.1 Medium
- flowiseai flowiseCritical Multi-Tenant Variable Disclosure in Flowise Cloud via Custom JavaScript FunctionCVE-2025-594349.6 Critical
- flowiseFlowise - Unsandboxed Remote Code Execution via Custom MCPCVE-2025-71336Fix available9.3 Critical
- flowiseFlowise - Arbitrary File Access via Missing Chat Flow ID ValidationCVE-2025-71334Fix available9.3 Critical
- flowiseFlowise - Arbitrary File Read via chatId ParameterCVE-2025-71324Fix available8.7 High
- flowiseai flowiseFlowise has Remote Code Execution vulnerabilityCVE-2025-59528Public exploitFix availableEPSS 91.7%10.0 Critical
- flowiseai flowiseFlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerabilityCVE-2025-59527Fix available7.5 High
- flowiseai flowiseFlowiseAI Pre-Auth Arbitrary Code ExecutionCVE-2025-57164Fix available6.5 Medium
- flowiseai flowiseFlowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account TakeoverCVE-2025-58434Public exploitFix availableEPSS 83.8%9.8 Critical
- flowiseai flowiseUnsupervised OS command execution leads to remote code execution by unauthenticated network attackersCVE-2025-8943Public exploitEPSS 75.3%9.8 Critical
- flowiseai flowiseFlowise Vulnerable to SQL Injection via `tableName` ParameterCVE-2025-29189Fix available7.6 High
- flowiseFlowise - SQL Injection in importChatflows API via chatflow.id ParameterCVE-2025-713328.5 High
- flowiseFlowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store APICVE-2025-71338Public exploit10.0 Critical
- flowiseFlowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments EndpointCVE-2025-713339.3 Critical
- flowiseai flowiseFlowiseAI Flowise arbitrary file upload vulnerabilityCVE-2025-26319Public exploitEPSS 55.9%9.8 Critical
- flowiseFlowise - Remote Code Execution via overrideConfig ParameterCVE-2024-58351Fix available9.3 Critical
- flowiseai embed, flowise, flowisechatembed +2 moreFlowise Stored Cross-Site ScriptingCVE-2024-9148Fix available9.6 Critical
- flowiseai flowiseFlowise Authentication BypassCVE-2024-8181EPSS 45.1%9.8 Critical
- flowiseai flowiseFlowise Denial of ServiceCVE-2024-8182EPSS 13.9%7.5 High
- flowiseai flowiseGHSL-2023-248: Flowise xss in /api/v1/credentials/idCVE-2024-371466.1 Medium
- flowiseai flowiseGHSL-2023-247: Flowise xss in /api/v1/chatflows-streaming/idCVE-2024-371456.1 Medium
- flowiseai flowiseGHSL-2023-246: Flowise xss in /api/v1/public-chatflows/idCVE-2024-364236.1 Medium
- flowiseai flowiseGHSL-2023-245: Flowise xss in api/v1/chatflows/idCVE-2024-364226.1 Medium
- flowiseai flowiseGHSL-2023-234: Flowise Cors Misconfiguration in packages/server/src/index.tsCVE-2024-364217.5 High
- flowiseai flowiseGHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-fileCVE-2024-36420Public exploit7.5 High
- Show moreLoading…