Skip to contentFlowiseai vulnerabilities
Newest
- flowiseai flowiseFlowise: SSRF Protection Bypass via IPv4-Mapped IPv6 AddressesCVE-2026-69257Fix available7.6 High
- flowiseai flowiseFlowise: Remote Code Execution Vulnerability in CSVAgentCVE-2026-69256Fix available9.4 Critical
- flowiseai flowiseFlowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell VerifiedCVE-2026-69255Fix available9.2 Critical
- flowiseai flowiseFlowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions OverrideCVE-2026-69254Public exploitFix available9.4 Critical
- flowiseai flowiseFlowise Sandbox Escape to RCECVE-2026-69253Fix available9.0 Critical
- flowiseai flowiseFlowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organizationCVE-2026-69252Fix available7.2 High
- flowiseai flowise, flowise-components +1 moreFlowise RCE via TypeORM DataSourceCVE-2026-69251Fix available9.0 Critical
- flowiseai flowiseFlowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret ExfiltrationCVE-2026-69250Fix available8.5 High
- flowiseai flowiseFlowise before 3.1.3 IDOR via customer-default-source endpointCVE-2026-73488Fix available6.0 Medium
- flowiseFlowise - Custom MCP Environment Variable Denylist Bypass via Case SensitivityCVE-2026-58057Public exploit2.3 Low
- flowiseai flowiseFlowiseAI Flowise S3 Document Loader S3.ts path traversalCVE-2026-128215.3 Medium
- flowiseFlowise - Cross-Workspace Information Disclosure via chatflows/apikey EndpointCVE-2026-56268Fix available5.3 Medium
- flowiseFlowise - Mass Assignment in PUT /api/v1/user Allows Password Hash OverrideCVE-2026-56276Fix available6.0 Medium
- flowiseFlowise - Hardcoded CORS Wildcard in TTS EndpointCVE-2026-56277Fix available6.9 Medium
- flowiseai flowiseFlowise: Evaluator create+update mass-assignment allows cross-workspace evaluator takeoverCVE-2026-46480Fix available7.7 High
- flowiseai flowiseFlowise: Evaluation create+update mass-assignment allows cross-workspace evaluation takeoverCVE-2026-46479Fix available7.7 High
- flowiseai flowiseFlowise: DatasetRow create+update mass-assignment allows cross-workspace row takeoverCVE-2026-46478Fix available7.7 High
- flowiseai flowiseFlowise: Dataset create+update mass-assignment allows cross-workspace dataset takeoverCVE-2026-46477Fix available7.7 High
- flowiseai flowiseFlowise: CustomTemplate create+update mass-assignment allows cross-workspace template takeoverCVE-2026-46476Fix available7.7 High
- flowiseai flowiseFlowise: Assistant create+update mass-assignment allows cross-workspace assistant takeoverCVE-2026-46475Fix available7.7 High
- flowiseai flowiseFlowise: Vector Store No Permission ChecksCVE-2026-46444Fix available8.7 High
- flowiseai flowiseFlowise: Credential Data LeakCVE-2026-46443Fix available7.0 High
- flowiseai flowiseFlowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox EscapeCVE-2026-46442Fix availableEPSS 33.0%9.4 Critical
- flowiseai flowiseFlowise: Mass Assignment in Assistant Update Endpoint Allows Cross-Workspace Resource ReassignmentCVE-2026-46441Fix available7.6 High
- flowise, flowise components +1 moreFlowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccessCVE-2026-56274Public exploitFix available8.7 High
- flowiseai flowiseFlowise: Basic Auth Credentials Exposed via APICVE-2026-46440Fix available7.5 High
- flowiseai flowiseFlowise: Mass Assignment in Chatflow Update Endpoint Allows Cross-Workspace AgentFlow ReassignmentCVE-2026-42863Fix available7.6 High
- flowiseai flowiseFlowise: Mass Assignment in Tool Update Endpoint Allows Cross-Workspace Resource ReassignmentCVE-2026-42862Fix available7.6 High
- flowiseai flowiseFlowise: Mass Assignment in Variable Update Endpoint Allows Cross-Workspace Resource ReassignmentCVE-2026-42861Fix available7.6 High
- flowiseai flowiseFlowiseAI Flowise Endpoint account.service.ts verify information disclosureCVE-2026-80286.3 Medium
- flowiseai flowiseFlowiseAI Flowise User Controller authorizationCVE-2026-80275.3 Medium
- flowiseai flowiseFlowiseAI Flowise API Response account.service.ts login information disclosureCVE-2026-80266.3 Medium
- flowiseai flowiseFlowise: CSV Agent Prompt Injection Remote Code Execution VulnerabilityCVE-2026-41264Public exploitFix available9.2 Critical
- flowiseai flowiseFlowise: Airtable_Agent Code Injection Remote Code Execution VulnerabilityCVE-2026-41265Fix available9.2 Critical
- flowiseai flowiseFlowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentialsCVE-2026-41279Fix available8.2 High
- flowiseai flowiseFlowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDsCVE-2026-41278Fix available8.7 High
- flowiseai flowiseFlowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR)CVE-2026-41277Fix available7.6 High
- flowiseai flowiseFlowise: AccountService resetPassword Authentication Bypass VulnerabilityCVE-2026-41276Fix available7.7 High
- flowiseai flowise, flowise-components +1 moreFlowise: Cypher Injection in GraphCypherQAChainCVE-2026-41274Fix available9.3 Critical
- flowiseai flowiseFlowise: Password Reset Link Sent Over Unsecured HTTPCVE-2026-41275Fix available7.5 High
- flowiseai flowiseFlowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public ChatflowCVE-2026-41273Fix available7.7 High
- flowiseai flowise, flowise-components +1 moreFlowise: APIChain Prompt Injection SSRF in GET/POST API ChainsCVE-2026-41271Fix available7.1 High
- flowiseai flowise, flowise-components +1 moreFlowise: SSRF Protection Bypass (TOCTOU & Default Insecure)CVE-2026-41272Fix available7.1 High
- flowiseai flowise, flowise-components +1 moreFlowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function SandboxCVE-2026-41270Fix available7.1 High
- flowiseai flowiseFlowise: File Upload Validation Bypass in createAttachmentCVE-2026-41269Fix available7.1 High
- flowiseai flowiseFlowise: Flowise Parameter Override Bypass Remote Command ExecutionCVE-2026-41268Fix availableEPSS 17.4%7.7 High
- flowiseai flowiseFlowise: Sensitive Data Leak in public-chatbotConfigCVE-2026-41266Fix available7.7 High
- flowiseai flowiseFlowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization AssociationCVE-2026-41267Fix available8.1 High
- flowiseai flowise, flowise-components +1 moreFlowise: Code Injection in CSVAgent leads to Authenticated RCECVE-2026-41137Fix available9.4 Critical
- flowiseai flowiseFlowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using Pandas.CVE-2026-41138Fix available8.3 High
- Show moreLoading…