FL
Vendor
Flowise
26
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-56271 | FL Flowise Flowise | 9.8 | Jul 12 | Flowise - Weak Default JWT Secrets in Authentication Middleware |
| CVE-2026-56273 | FL Flowise Flowise | 6.5 | Jul 8 | Flowise - Path Traversal in Vector Store basePath Parameter |
| CVE-2026-56278 | FL Flowise Flowise | 9.1 | Jun 30 | Flowise - Session Hijacking via Weak Default Express Session Secret |
| CVE-2026-56277 | FL Flowise Flowise | 6.5 | Jun 30 | Flowise - Hardcoded CORS Wildcard in TTS Endpoint |
| CVE-2026-58057 | FL Flowise Flowise | 5.0 | Jun 28 | Flowise - Custom MCP Environment Variable Denylist Bypass via Case Sensitivity |
| CVE-2025-71338 | FL Flowise Flowise | 9.8 | Jun 25 | Flowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store API |
| CVE-2025-71336 | FL Flowise Flowise | 9.8 | Jun 25 | Flowise - Unsandboxed Remote Code Execution via Custom MCP |
| CVE-2025-71335 | FL Flowise Flowise | 8.1 | Jun 25 | Flowise - Session Invalidation Failure After Password Change |
| CVE-2025-71334 | FL Flowise Flowise | 9.8 | Jun 25 | Flowise - Arbitrary File Access via Missing Chat Flow ID Validation |
| CVE-2025-71333 | FL Flowise Flowise | 9.8 | Jun 25 | Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint |
| CVE-2025-71328 | FL Flowise Flowise | 8.8 | Jun 25 | Flowise - Unverified Password Change via Account Settings |
| CVE-2025-71327 | FL Flowise Flowise | 9.1 | Jun 25 | Flowise - Authentication Bypass via Unprotected Registration Endpoint |
| CVE-2025-71324 | FL Flowise Flowise | 7.5 | Jun 25 | Flowise - Arbitrary File Read via chatId Parameter |
| CVE-2026-56272 | FL Flowise Flowise | 4.1 | Jun 24 | Flowise - Insufficient Password Salt Rounds in Bcrypt Hashing |
| CVE-2026-56270 | FL Flowise Flowise | 7.5 | Jun 24 | Flowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint |
| CVE-2026-56269 | FL Flowise Flowise | 4.6 | Jun 24 | Flowise - Weak Default Token Hash Secret in JWT Token Encryption |
| CVE-2025-71332 | FL Flowise Flowise | 8.8 | Jun 24 | Flowise - SQL Injection in importChatflows API via chatflow.id Parameter |
| CVE-2026-56275 | FL Flowise Flowise | 7.1 | Jun 23 | Flowise - Server-Side Request Forgery via Execute Flow Base URL |
| CVE-2026-56274 | FL Flowise Flowise | 9.9 | Jun 23 | Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess |
| CVE-2025-71337 | FL Flowise Flowise | 8.3 | Jun 23 | Flowise - Unverified Email Change via Account Profile Endpoint |
| CVE-2026-56268 | FL Flowise Flowise | 7.7 | Jun 22 | Flowise - Cross-Workspace Information Disclosure via chatflows/apikey Endpoint |
| CVE-2026-56276 | FL Flowise Flowise | 6.0 | Jun 20 | Flowise - Mass Assignment in PUT /api/v1/user Allows Password Hash Override |
| CVE-2026-56267 | FL Flowise Flowise | 6.9 | Jun 20 | Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint |
| CVE-2025-71331 | FL Flowise Flowise | 6.1 | Jun 20 | Flowise - Cross-Site Scripting in Chat Messages and Agent Workflows |
| CVE-2024-58351 | FL Flowise Flowise | 9.8 | Jun 20 | Flowise - Remote Code Execution via overrideConfig Parameter |