FL
Product
Flowise
25
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 9High 8Medium 8Low 0
Watch
Add Flowise to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-56274 | 9.9 | Jun 23 | Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess Affected: before 3.1.2 |
| CVE-2026-56271 | 9.8 | Jul 12 | Flowise - Weak Default JWT Secrets in Authentication Middleware Affected: before 3.1.0 |
| CVE-2025-71338 | 9.8 | Jun 25 | Flowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store API Affected: through 2.2.7 |
| CVE-2025-71336 | 9.8 | Jun 25 | Flowise - Unsandboxed Remote Code Execution via Custom MCP Affected: before 3.0.6 |
| CVE-2025-71334 | 9.8 | Jun 25 | Flowise - Arbitrary File Access via Missing Chat Flow ID Validation Affected: before 3.0.6 |
| CVE-2025-71333 | 9.8 | Jun 25 | Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint Affected: through 2.2.4 |
| CVE-2024-58351 | 9.8 | Jun 20 | Flowise - Remote Code Execution via overrideConfig Parameter Affected: before 2.1.4 |
| CVE-2026-56278 | 9.1 | Jun 30 | Flowise - Session Hijacking via Weak Default Express Session Secret Affected: before 3.1.0 |
| CVE-2025-71327 | 9.1 | Jun 25 | Flowise - Authentication Bypass via Unprotected Registration Endpoint Affected: 3.0.1 |
| CVE-2025-71328 | 8.8 | Jun 25 | Flowise - Unverified Password Change via Account Settings Affected: before 3.0.10 |
| CVE-2025-71332 | 8.8 | Jun 24 | Flowise - SQL Injection in importChatflows API via chatflow.id Parameter Affected: through 2.2.7 |
| CVE-2025-71337 | 8.3 | Jun 23 | Flowise - Unverified Email Change via Account Profile Endpoint Affected: before 3.0.10 |
| CVE-2025-71335 | 8.1 | Jun 25 | Flowise - Session Invalidation Failure After Password Change Affected: before 3.0.10 |
| CVE-2026-56268 | 7.7 | Jun 22 | Flowise - Cross-Workspace Information Disclosure via chatflows/apikey Endpoint Affected: before 3.1.2 |
| CVE-2025-71324 | 7.5 | Jun 25 | Flowise - Arbitrary File Read via chatId Parameter Affected: before 3.0.6 |
| CVE-2026-56270 | 7.5 | Jun 24 | Flowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint Affected: before 3.1.0 |
| CVE-2026-56275 | 7.1 | Jun 23 | Flowise - Server-Side Request Forgery via Execute Flow Base URL Affected: before 3.1.0; before 3.1.0 |
| CVE-2026-56267 | 6.9 | Jun 20 | Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint Affected: before 3.0.13 |
| CVE-2026-56273 | 6.5 | Jul 8 | Flowise - Path Traversal in Vector Store basePath Parameter Affected: before 3.1.0; before 3.1.0 |
| CVE-2026-56277 | 6.5 | Jun 30 | Flowise - Hardcoded CORS Wildcard in TTS Endpoint Affected: before 3.1.2 |
| CVE-2025-71331 | 6.1 | Jun 20 | Flowise - Cross-Site Scripting in Chat Messages and Agent Workflows Affected: before 3.0.8 |
| CVE-2026-56276 | 6.0 | Jun 20 | Flowise - Mass Assignment in PUT /api/v1/user Allows Password Hash Override Affected: before 3.1.2 |
| CVE-2026-58057 | 5.0 | Jun 28 | Flowise - Custom MCP Environment Variable Denylist Bypass via Case Sensitivity Affected: before 3.1.3 |
| CVE-2026-56269 | 4.6 | Jun 24 | Flowise - Weak Default Token Hash Secret in JWT Token Encryption Affected: before 3.1.0 |
| CVE-2026-56272 | 4.1 | Jun 24 | Flowise - Insufficient Password Salt Rounds in Bcrypt Hashing Affected: before 3.0.13 |
Showing 25