Login Request a demo
FL
Product
Flowise
by Flowise · last CVE Jul 12, 2026
25
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities25In the news0Timeline
Severity mix
Critical 9High 8Medium 8Low 0
Severity
All severities25Critical9High8Medium8Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Flowise to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-56274
9.9
8%
Jun 23
Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess
Affected: before 3.1.2
CVE-2026-56271
9.8
1%
Jul 12
Flowise - Weak Default JWT Secrets in Authentication Middleware
Affected: before 3.1.0
CVE-2025-71338
9.8
1%
Jun 25
Flowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store API
Affected: through 2.2.7
CVE-2025-71336
9.8
1%
Jun 25
Flowise - Unsandboxed Remote Code Execution via Custom MCP
Affected: before 3.0.6
CVE-2025-71334
9.8
4%
Jun 25
Flowise - Arbitrary File Access via Missing Chat Flow ID Validation
Affected: before 3.0.6
CVE-2025-71333
9.8
1%
Jun 25
Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint
Affected: through 2.2.4
CVE-2024-58351
9.8
1%
Jun 20
Flowise - Remote Code Execution via overrideConfig Parameter
Affected: before 2.1.4
CVE-2026-56278
9.1
1%
Jun 30
Flowise - Session Hijacking via Weak Default Express Session Secret
Affected: before 3.1.0
CVE-2025-71327
9.1
1%
Jun 25
Flowise - Authentication Bypass via Unprotected Registration Endpoint
Affected: 3.0.1
Showing 9