flowise

Records86

1. closed9.0
   Flowise CVE-2026-119978: Flowise Sandbox Escape Leads to OS Command Execution

   Patch now · Disclosed · since 30 Oct 2026 · CVE-2026-119978

   AI
2. closed9.2
   Flowise CVE-2026-100606: Flowise enterprise mode SSO login authentication bypass

   Patch now · Disclosed · since 26 Sep 2026 · CVE-2026-100606

   AI
3. closed7.6
   Flowise CVE-2026-100609: Flowise credential lookup lacks workspace isolation

   Patch now · Disclosed · since 26 Sep 2026 · CVE-2026-100609

   AI
4. closed8.7
   Flowise CVE-2026-100608: Flowise lacks proper authorization on BullMQ admin dashboard

   Patch now · Disclosed · since 26 Sep 2026 · CVE-2026-100608

   AI
5. closed7.7
   Flowise CVE-2026-100610: Flowise missing permission checks on upsert-history endpoints

   Patch now · Disclosed · since 26 Sep 2026 · CVE-2026-100610

   AI
6. closed7.6
   Flowise Flowise Document Loader SSRF Vulnerability

   Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-91938

   AI
7. closed9.0
   Flowise Flowise Validation Bypass Vulnerability in MCP Server Configuration

   Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-91932

   AI
8. closed8.8
   Flowise CVE-2026-91934: Flowise Path Validation Flaw in SQL Database Chain Node

   Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-91934

   AI
9. closed8.3
   Flowise CVE-2026-91936: Flowise Script Injection Vulnerability in Docker Build Workflows

   Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-91936

   AI
10. closed7.6
    Flowise CVE-2026-91933: Flowise Workspace Authorization Bypass in Realtime Endpoints

    Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-91933

    AI
11. closed8.7
    Flowise Flowise MongoDBMemory Node Query Injection Exposes Chat History

    Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-91937

    AI
12. closed7.6
    Flowise Flowise Cross-Tenant Authorization Gaps in Enterprise Endpoints

    Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-91929

    AI
13. closed8.7
    Flowise Flowise baseURL Parameter Validation Flaw Allows Request Redirection

    Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-91935

    AI
14. closed6.3
    Flowise CVE-2026-90580: Flowise Server-Side Request Forgery Vulnerability

    Patch now · Disclosed · since 13 Sep 2026 · CVE-2026-90580

    AI
15. closed7.5
    Flowise CVE-2026-90535: Flowise Denial of Service Vulnerability

    Patch now · Disclosed · since 12 Sep 2026 · CVE-2026-90535

    AI
16. closed8.6
    Flowise CVE-2026-73484: Flowise pythonCodeValidator sandbox escape vulnerability

    Patch now · Disclosed · since 13 Aug 2026 · CVE-2026-73484

    AI
17. closed8.7
    Flowise CVE-2026-71962: Flowise Missing Authorization on Assistant File Download

    Patch now · Disclosed · since 10 Aug 2026 · CVE-2026-71962

    AI
18. closed7.7
    Flowise CVE-2026-67620: Flowise SSRF Vulnerability in Metadata Guard

    Patch now · Disclosed · since 8 Aug 2026 · CVE-2026-67620

    AI
19. closed
    Flowise Flowise Unauthenticated TTS Credential Abuse

    Patch now · Disclosed · since 4 Aug 2026

    AI
20. closed9.4
    Flowise CVE-2026-69256: Flowise Remote Code Execution Vulnerability in CSVAgent

    Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-69256

    AI
21. closed9.4
    Flowise CVE-2026-69254: Flowise RCE via NodeVM Sandbox Escape in executeJavaScriptCode

    Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-69254

    AI
22. closed9.4
    Flowise CVE-2026-69264: Flowise RCE via CSVAgent data URI Python interpolation

    Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-69264

    AI
23. closed7.6
    Flowise CVE-2026-70474: Flowise Cross-Workspace OAuth2 Credential Metadata Leak

    Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-70474

    AI
24. closed9.2
    Flowise CVE-2026-69255: Flowise CSV Agent Remote Code Execution via Pyodide Code Injection

    Patch now · Exploited · since 4 Aug 2026 · CVE-2026-69255

    AI
25. closed8.5
    Flowise CVE-2026-69250: Flowise Unauthenticated OAuth2 Refresh Enables SSRF and Secret Exfiltration

    Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-69250

    AI
26. closed9.5
    Flowise CVE-2026-70470: Flowise Pyodide Validator Unicode Homoglyph Bypass Leads to RCE

    Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-70470

    AI
27. closed9.0
    Flowise CVE-2026-69251: Flowise RCE via TypeORM DataSource

    Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-69251

    AI
28. closed9.2
    Flowise CVE-2026-70478: Flowise Unauthenticated OAuth2 Token Refresh Endpoint Allows Token Theft

    Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-70478

    AI
29. closed7.2
    Flowise CVE-2026-69252: Flowise Missing Authorization on File Routes

    Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-69252

    AI
30. closed9.0
    Flowise CVE-2026-69253: Flowise Sandbox Escape to Remote Code Execution

    Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-69253

    AI
31. closed8.3
    Flowise CVE-2026-70473: Flowise Information Disclosure via Upsert History

    Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-70473

    AI
32. closed7.1
    Flowise CVE-2026-70475: Flowise Missing Authorization on Execution Update

    Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-70475

    AI
33. closed9.4
    Flowise CVE-2026-69259: Flowise RCE via SQLite Record Manager Node

    Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-69259

    AI
34. closed7.1
    Flowise CVE-2026-69262: Flowise resource validation flaw in deletion API

    Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-69262

    AI
35. closed7.1
    Flowise CVE-2026-70471: Flowise RBAC bypass leads to workspace variable disclosure

    Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-70471

    AI
36. closed
    Flowise Flowise incomplete credential redaction exposes secrets

    Patch now · Disclosed · since 4 Aug 2026

    AI
37. closed8.8
    Flowise CVE-2026-69258: Flowise unauthenticated property injection in prediction API

    Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-69258

    AI
38. closed7.1
    Flowise CVE-2026-70472: Flowise cross-workspace credential IDOR vulnerability

    Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-70472

    AI
39. closed9.5
    Flowise Flowise CSV Agent prompt injection leads to remote code execution

    Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-70477

    AI
40. closed9.3
    Flowise CVE-2026-56278: Flowise uses a hardcoded default session secret enabling authentication bypass

    Patch now · Disclosed · since 30 Jun 2026 · CVE-2026-56278

    AI
41. closed6.9
    Flowise CVE-2026-56277: Flowise text-to-speech endpoint suffers from improper CORS configuration

    Patch now · Disclosed · since 30 Jun 2026 · CVE-2026-56277

    AI
42. closed8.7
    Flowise Flowise Unverified Email Change Vulnerability

    Patch now · Disclosed · since 23 Jun 2026 · CVE-2025-71337

    AI
43. closed7.7
    Flowise CVE-2026-56268: Flowise cross-workspace chatflow information disclosure

    Patch now · Disclosed · since 20 May 2026 · updated 22 Jun 2026 · CVE-2026-56268

    AI
44. closed
    Flowise Flowise hardcoded CORS wildcard on TTS endpoint

    Patch now · Disclosed · since 20 May 2026

    AI
45. closed
    Flowise Flowise mass assignment password override vulnerability

    Patch now · Disclosed · since 20 May 2026

    AI
46. closed7.6
    Flowise CVE-2026-46441: FlowiseAI Mass Assignment Vulnerability in Assistant Update

    Patch now · Disclosed · since 14 May 2026 · updated 8 Jun 2026 · CVE-2026-46441

    AI
47. closed7.0
    Flowise CVE-2026-46443: FlowiseAI Vulnerable to Credential Data Leak

    Patch now · Disclosed · since 14 May 2026 · updated 8 Jun 2026 · CVE-2026-46443

    AI
48. closed8.8
    Flowise CVE-2026-46480: FlowiseAI mass-assignment allows cross-workspace evaluator takeover

    Patch now · Disclosed · since 14 May 2026 · updated 8 Jun 2026 · CVE-2026-46480

    AI
49. closed8.8
    Flowise CVE-2026-46479: FlowiseAI mass-assignment allows cross-workspace evaluation takeover

    Patch now · Disclosed · since 14 May 2026 · updated 8 Jun 2026 · CVE-2026-46479

    AI
50. closed6.3
    Flowise Flowise API response handler exposes bcrypt password hashes

    Patch now · Disclosed · since 6 May 2026 · CVE-2026-8026

    AI
51. closed8.2
    Flowise CVE-2026-41279: Flowise Unauthenticated TTS Endpoint Accepts Arbitrary Credential IDs

    Patch now · Disclosed · since 17 Apr 2026 · updated 23 Apr 2026 · CVE-2026-41279

    AI
52. closed8.8
    Flowise CVE-2026-41277: Flowise Mass Assignment Leads to Cross-Workspace Object Takeover

    Patch now · Disclosed · since 17 Apr 2026 · updated 23 Apr 2026 · CVE-2026-41277

    AI
53. closed7.1
    Flowise CVE-2026-41270: Flowise SSRF Protection Bypass via Built-in HTTP Modules

    Patch now · Disclosed · since 16 Apr 2026 · updated 23 Apr 2026 · CVE-2026-41270

    AI
54. closed5.3
    Flowise CVE-2026-56270: Flowise Unauthenticated Information Disclosure of OAuth Secrets

    Patch now · Disclosed · since 16 Apr 2026 · updated 24 Jun 2026 · CVE-2026-56270

    AI
55. closed7.7
    Flowise CVE-2026-41268: Flowise Parameter Override Bypass Remote Command Execution

    Patch now · Disclosed · since 16 Apr 2026 · updated 23 Apr 2026 · CVE-2026-41268

    AI
56. closed7.1
    Flowise CVE-2026-41272: Flowise SSRF Protection Bypass via DNS Rebinding and Default Insecure Config

    Patch now · Disclosed · since 16 Apr 2026 · updated 23 Apr 2026 · CVE-2026-41272

    AI
57. closed5.3
    Flowise CVE-2026-43995: Flowise SSRF Protection Bypass via Direct HTTP Client Usage

    Patch now · Disclosed · since 16 Apr 2026 · updated 11 May 2026 · CVE-2026-43995

    AI
58. closed
    Flowise Flowise Weak Default JWT Secrets Vulnerability

    Patch now · Disclosed · since 16 Apr 2026

    AI
59. closed5.6
    Flowise CVE-2026-56269: Flowise Weak Default Token Hash Secret Vulnerability

    Patch now · Disclosed · since 16 Apr 2026 · updated 24 Jun 2026 · CVE-2026-56269

    AI
60. closed8.7
    Flowise CVE-2026-41274: Flowise Cypher Injection Vulnerability in GraphCypherQAChain

    Patch now · Disclosed · since 16 Apr 2026 · updated 23 Apr 2026 · CVE-2026-41274

    AI
61. closed7.1
    Flowise CVE-2026-31829: Flowise Affected by Server-Side Request Forgery in HTTP Node

    Patch now · Disclosed · since 11 Mar 2026 · updated 11 Mar 2026 · CVE-2026-31829

    AI
62. closed8.2
    Flowise CVE-2026-30821: Flowise Arbitrary File Upload via MIME Spoofing

    Patch now · Disclosed · since 6 Mar 2026 · updated 7 Mar 2026 · CVE-2026-30821

    AI
63. closed8.8
    Flowise CVE-2026-30823: Flowise IDOR and SSO Configuration Vulnerability

    Patch now · Disclosed · since 6 Mar 2026 · updated 7 Mar 2026 · CVE-2026-30823

    AI
64. closed8.7
    Flowise CVE-2026-30820: Flowise Authorization Bypass via Spoofed Header

    Patch now · Disclosed · since 6 Mar 2026 · updated 7 Mar 2026 · CVE-2026-30820

    AI
65. closed7.7
    Flowise CVE-2026-30822: Flowise Allows Mass Assignment on Leads Endpoint

    Patch now · Disclosed · since 6 Mar 2026 · updated 7 Mar 2026 · CVE-2026-30822

    AI
66. closed
    Flowise Flowise Vulnerable to PII Disclosure

    Patch now · Disclosed · since 5 Mar 2026

    AI
67. closed5.6
    Flowise CVE-2026-56272: Flowise Insufficient Password Salt Rounds

    Patch now · Disclosed · since 5 Mar 2026 · updated 24 Jun 2026 · CVE-2026-56272

    AI
68. closed
    Flowise Flowise authentication bypass using unprotected registration endpoint

    Patch now · Disclosed · since 17 Nov 2025

    AI
69. closed
    Flowise Flowise fails to invalidate sessions after password changes

    Patch now · Disclosed · since 14 Nov 2025

    AI
70. closed
    Flowise FlowiseAI Pre-Authentication Arbitrary Code Execution

    Patch now · Disclosed · since 17 Oct 2025

    AI
71. closed
    Flowise Flowise vulnerable to arbitrary file exposure

    Patch now · Disclosed · since 10 Oct 2025

    AI
72. closed9.6
    Flowise CVE-2025-59434: Cross-tenant environment variable exposure in Flowise Cloud

    Patch now · Disclosed · since 22 Sep 2025 · CVE-2025-59434

    AI
73. closed7.5
    Flowise CVE-2025-59527: Server-Side Request Forgery vulnerability in Flowise

    Patch now · Disclosed · since 22 Sep 2025 · updated 22 Sep 2025 · CVE-2025-59527

    AI
74. closed9.8
    Flowise CVE-2025-58434: Flowise Unauthenticated Password Reset Vulnerability

    Patch now · Disclosed · since 12 Sep 2025 · CVE-2025-58434

    AI
75. closed9.8
    Flowise CVE-2025-8943: Flowise OS command remote code execution

    Patch now · Disclosed · since 14 Aug 2025 · CVE-2025-8943

    AI
76. closed5.9
    Flowise Flowise SQL Injection Vulnerability in Import Chatflows API

    Patch now · Disclosed · since 24 Jun 2026 · updated 24 Jun 2026 · CVE-2025-71332

    AI
77. closed
    Flowise Flowise Pre-Authentication Arbitrary File Upload Vulnerability

    Patch now · Disclosed · since 13 Mar 2025

    AI
78. closed8.9
    Flowise Arbitrary File Upload Vulnerability in FlowiseAI Flowise

    Patch now · Disclosed · since 4 Mar 2025 · updated 5 Mar 2025 · CVE-2025-26319

    AI
79. closed8.6
    Flowise CVE-2024-8181: Flowise authentication bypass vulnerability

    Patch now · Disclosed · since 27 Aug 2024 · CVE-2024-8181

    AI
80. closed8.7
    Flowise CVE-2024-8182: Flowise unauthenticated denial of service vulnerability

    Patch now · Disclosed · since 27 Aug 2024 · CVE-2024-8182

    AI
81. closed8.7
    Flowise CVE-2024-36420: Flowise Path Injection Vulnerability

    Patch now · Disclosed · since 5 Aug 2024 · updated 5 Aug 2024 · CVE-2024-36420

    AI
82. closed6.1
    Flowise CVE-2024-36422: Flowise Cross-site Scripting Vulnerability

    Patch now · Disclosed · since 5 Aug 2024 · updated 5 Aug 2024 · CVE-2024-36422

    AI
83. closed6.1
    Flowise CVE-2024-37146: Flowise Cross-site Scripting Vulnerability

    Patch now · Disclosed · since 5 Aug 2024 · updated 5 Aug 2024 · CVE-2024-37146

    AI
84. closed6.1
    Flowise CVE-2024-37145: Flowise Cross-site Scripting Vulnerability

    Patch now · Disclosed · since 5 Aug 2024 · updated 5 Aug 2024 · CVE-2024-37145

    AI
85. closed6.1
    Flowise CVE-2024-36423: Flowise reflected cross-site scripting

    Patch now · Disclosed · since 5 Aug 2024 · updated 5 Aug 2024 · CVE-2024-36423

    AI
86. closed8.7
    Flowise CVE-2024-36421: Flowise CORS misconfiguration vulnerability

    Patch now · Disclosed · since 5 Aug 2024 · updated 5 Aug 2024 · CVE-2024-36421

    AI