Login Request a demo
FL
Product
Flowise
by FlowiseAI · last CVE Sep 26, 2026
146
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities146In the news6Timeline
Severity mix
Critical 39High 78Medium 28Low 1
Severity
All severities146Critical39High78Medium28Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Flowise to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-69250
7.5
1%
Aug 4
Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration
Affected: < 3.1.3
CVE-2025-71324
7.5
2%
Jun 25
Flowise - Arbitrary File Read via chatId Parameter
Affected: before 3.0.6
CVE-2026-56270
7.5
2%
Jun 24
Flowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint
Affected: before 3.1.0
CVE-2026-41279
7.5
0%
Apr 23
Flowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials
Affected: < 3.1.0
CVE-2026-41278
7.5
0%
Apr 23
Flowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDs
Affected: < 3.1.0
CVE-2026-41275
7.5
0%
Apr 23
Flowise: Password Reset Link Sent Over Unsecured HTTP
Affected: < 3.1.0
CVE-2026-41266
7.5
4%
Apr 23
Flowise: Sensitive Data Leak in public-chatbotConfig
Affected: < 3.1.0
CVE-2025-59527
7.5
5%
Sep 22
FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability
Affected: = 3.0.5
CVE-2024-8182
7.5
14%
Aug 27
Flowise Denial of Service
Affected: 1.8.2
CVE-2024-36421
7.5
8%
Jul 1
GHSL-2023-234: Flowise Cors Misconfiguration in packages/server/src/index.ts
Affected: <= 1.4.3
CVE-2024-36420
7.5
2%
Jul 1
GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-file
Affected: <= 1.4.3
CVE-2026-100605
7.1
0%
Sep 26
Flowise through 3.1.4 Missing Authorization via Chat Message Routes
Affected: through 3.1.4
CVE-2026-91938
7.1
0%
Sep 15
Flowise before 3.1.4 Server-Side Request Forgery via document loaders
Affected: before 3.1.4; before 3.1.4
CVE-2026-91933
7.1
0%
Sep 15
Flowise before 3.1.4 Authorization Bypass via openai-realtime
Affected: before 3.1.4
CVE-2026-91929
7.1
0%
Sep 15
Flowise before 3.1.4 Cross-Tenant Authorization Bypass
Affected: before 3.1.4
CVE-2026-56275
7.1
0%
Jun 23
Flowise - Server-Side Request Forgery via Execute Flow Base URL
Affected: before 3.1.0
CVE-2026-41272
7.1
0%
Apr 23
Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)
Affected: < 3.1.0
CVE-2026-100609
6.8
0%
Sep 26
Flowise through 3.1.4 Insecure Direct Object Reference via Credential
Affected: through 3.1.4; through 3.1.4
CVE-2026-91936
6.8
0%
Sep 15
Flowise before 3.1.4 Script Injection via Docker Workflows
Affected: before 3.1.4
CVE-2026-90534
6.5
0%
Sep 12
Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method
Affected: before 3.1.4
CVE-2026-90533
6.5
0%
Sep 12
Flowise before 3.1.4 Broken Access Control via organizationuser
Affected: before 3.1.4
CVE-2026-73604
6.5
0%
Aug 13
Flowise before 3.1.3 Credential Exposure via API
Affected: before 3.1.3
CVE-2026-73488
6.5
0%
Aug 13
Flowise before 3.1.3 IDOR via customer-default-source endpoint
Affected: before 3.1.3
CVE-2026-70475
6.5
0%
Aug 4
Flowise: Missing Authorization on Execution Update Endpoint
Affected: < 3.1.2
CVE-2026-70471
6.5
0%
Aug 4
Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure
Affected: < 3.1.3
CVE-2026-56277
6.5
0%
Jun 30
Flowise - Hardcoded CORS Wildcard in TTS Endpoint
Affected: before 3.1.2
CVE-2026-46443
6.5
0%
Jun 8
Flowise: Credential Data Leak
Affected: < 3.1.2
CVE-2025-57164
6.5
1%
Oct 17
Flowise through v3.0.4 is vulnerable to remote code execution via unsanitized evaluation of user input in the "Supabase RPC Filter" field
Affected: 3.0.5
CVE-2026-90580
6.3
0%
Sep 13
FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery
Affected: 3.0.0; 3.0.1; 3.0.2
CVE-2026-12821
6.3
0%
Jun 21
FlowiseAI Flowise S3 Document Loader S3.ts path traversal
Affected: 3.1.0; 3.1.1; 3.1.2
CVE-2025-71331
6.1
0%
Jun 20
Flowise - Cross-Site Scripting in Chat Messages and Agent Workflows
Affected: before 3.0.8
CVE-2025-50538
6.1
15%
Oct 6
Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log
Affected: before 3.0.5
CVE-2025-29192
6.1
0%
Oct 6
Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log
Affected: before 3.0.5
CVE-2024-9148
6.1
1%
Sep 24
Flowise Stored Cross-Site Scripting
Affected: before 2.1.1
CVE-2024-37146
6.1
0%
Jul 1
GHSL-2023-248: Flowise xss in /api/v1/credentials/id
Affected: <= 1.4.3
CVE-2024-37145
6.1
0%
Jul 1
GHSL-2023-247: Flowise xss in /api/v1/chatflows-streaming/id
Affected: <= 1.4.3
CVE-2024-36423
6.1
0%
Jul 1
GHSL-2023-246: Flowise xss in /api/v1/public-chatflows/id
Affected: <= 1.4.3
CVE-2024-36422
6.1
0%
Jul 1
GHSL-2023-245: Flowise xss in api/v1/chatflows/id
Affected: <= 1.4.3
CVE-2026-73603
5.3
0%
Aug 13
Flowise before 3.1.4 Credential Abuse via Text-to-Speech
Affected: before 3.1.4
CVE-2026-8026
5.3
0%
May 6
FlowiseAI Flowise API Response account.service.ts login information disclosure
Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; 3.0.5; +7 more
CVE-2026-58057
5.0
2%
Jun 28
Flowise - Custom MCP Environment Variable Denylist Bypass via Case Sensitivity
Affected: before 3.1.3
CVE-2026-42862
5.0
0%
Jun 8
Flowise: Mass Assignment in Tool Update Endpoint Allows Cross-Workspace Resource Reassignment
Affected: < 3.1.2
CVE-2026-56269
4.6
0%
Jun 24
Flowise - Weak Default Token Hash Secret in JWT Token Encryption
Affected: before 3.1.0
CVE-2026-8027
4.3
0%
May 6
FlowiseAI Flowise User Controller authorization
Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; 3.0.5; +7 more
CVE-2026-56272
4.1
0%
Jun 24
Flowise - Insufficient Password Salt Rounds in Bcrypt Hashing
Affected: before 3.0.13
CVE-2026-8028
3.7
0%
May 6
FlowiseAI Flowise Endpoint account.service.ts verify information disclosure
Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; 3.0.5; +7 more
Page 3 of 3 · 146 total
123