Login Request a demo
FL
Vendor
FlowiseAI
4 products with CVEs on record
155
CVEs
0
On KEV
0
New 30D
Products
FL
Flowise
FlowiseAI
10.0
146 CVEs0 on KEV0 new
FL
flowise-components
FlowiseAI
9.9
7 CVEs0 on KEV0 new
EM
Embed
Flowiseai
6.1
1 CVEs0 on KEV0 new
FL
FlowiseChatEmbed
FlowiseAI
6.1
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-100610
FL
Flowise
FlowiseAI
7.5
0%
Sep 26Flowise through 3.1.4 Missing Authorization via upsert-history
CVE-2026-100609
FL
Flowise
FlowiseAI
6.8
0%
Sep 26Flowise through 3.1.4 Insecure Direct Object Reference via Credential
CVE-2026-100608
FL
Flowise
FlowiseAI
8.3
0%
Sep 26Flowise through 3.1.4 Authorization Bypass via BullMQ Dashboard
CVE-2026-100607
FL
Flowise
FlowiseAI
7.7
0%
Sep 26Flowise through 3.1.4 Authentication Bypass via Email-Only SSO
CVE-2026-100606
FL
Flowise
FlowiseAI
7.7
0%
Sep 26Flowise through 3.1.4 Authentication Bypass via SSO Email Match
CVE-2026-100605
FL
Flowise
FlowiseAI
7.1
0%
Sep 26Flowise through 3.1.4 Missing Authorization via Chat Message Routes
CVE-2026-91938
FL
Flowise
FlowiseAI
7.1
0%
Sep 15Flowise before 3.1.4 Server-Side Request Forgery via document loaders
CVE-2026-91937
FL
Flowise
FlowiseAI
7.5
0%
Sep 15Flowise before 3.1.4 NoSQL Injection via sessionId
CVE-2026-91936
FL
Flowise
FlowiseAI
6.8
0%
Sep 15Flowise before 3.1.4 Script Injection via Docker Workflows
CVE-2026-91935
FL
Flowise
FlowiseAI
8.3
0%
Sep 15Flowise before 3.1.4 SSRF and API Key Exfiltration via Chat Model Nodes
CVE-2026-91934
FL
Flowise
FlowiseAI
8.8
1%
Sep 15Flowise before 3.1.4 Remote Code Execution via SQL Database Chain
CVE-2026-91933
FL
Flowise
FlowiseAI
7.1
0%
Sep 15Flowise before 3.1.4 Authorization Bypass via openai-realtime
CVE-2026-91932
FL
Flowise
FlowiseAI
8.5
1%
Sep 15Flowise before 3.1.4 Remote Code Execution via cwd Parameter
CVE-2026-91931
FL
Flowise
FlowiseAI
8.5
1%
Sep 15Flowise before 3.1.4 Remote Code Execution via Custom MCP npx
CVE-2026-91930
FL
Flowise
FlowiseAI
7.5
0%
Sep 15Flowise before 3.1.4 Cross-Tenant Organization Admin Takeover
CVE-2026-91929
FL
Flowise
FlowiseAI
7.1
0%
Sep 15Flowise before 3.1.4 Cross-Tenant Authorization Bypass
CVE-2026-90580
FL
Flowise
FlowiseAI
6.3
0%
Sep 13FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery
CVE-2026-90535
FL
Flowise
FlowiseAI
7.5
0%
Sep 12Flowise before 3.1.4 Denial of Service via text-to-speech/abort
CVE-2026-90534
FL
Flowise
FlowiseAI
6.5
0%
Sep 12Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method
CVE-2026-90533
FL
Flowise
FlowiseAI
6.5
0%
Sep 12Flowise before 3.1.4 Broken Access Control via organizationuser
CVE-2026-52098
FL
Flowise
Flowiseai
9.8
1%
Sep 10An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpoint
CVE-2026-73604
FL
Flowise
FlowiseAI
6.5
0%
Aug 13Flowise before 3.1.3 Credential Exposure via API
CVE-2026-73603
FL
Flowise
FlowiseAI
5.3
0%
Aug 13Flowise before 3.1.4 Credential Abuse via Text-to-Speech
CVE-2026-73602
FL
Flowise
FlowiseAI
9.9
1%
Aug 13Flowise before 3.1.3 Sandbox Escape to RCE
CVE-2026-73601
FL
Flowise
FlowiseAI
8.8
1%
Aug 13Flowise before 3.1.3 Remote Code Execution via Custom MCP
CVE-2026-73488
FL
Flowise
FlowiseAI
6.5
0%
Aug 13Flowise before 3.1.3 IDOR via customer-default-source endpoint
CVE-2026-73487
FL
Flowise
FlowiseAI
9.8
1%
Aug 13Flowise before 3.1.3 Prompt Injection RCE via CSV Agent
CVE-2026-73486
FL
Flowise
FlowiseAI
8.8
1%
Aug 13Flowise before 3.1.3 Code Injection via CSV Agent customReadCSV
CVE-2026-73485
FL
Flowise
FlowiseAI
8.8
1%
Aug 13Flowise before 3.1.3 Remote Code Execution via Airtable Agent
CVE-2026-73484
FL
Flowise
FlowiseAI
8.1
0%
Aug 13Flowise before 3.1.3 Sandbox Escape via Pandas Methods
CVE-2026-73483
FL
Flowise
FlowiseAI
8.8
1%
Aug 13Flowise before 3.1.3 Sandbox Escape via Puppeteer
CVE-2026-71962
FL
Flowise
FlowiseAI
7.5
1%
Aug 10Flowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/download
CVE-2026-67620
FL
Flowise
FlowiseAI
7.7
0%
Aug 8Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-List
CVE-2026-70636
FL
Flowise
FlowiseAI
7.5
1%
Aug 6Flowise 3.1.4 Authentication Bypass via OAuth2 Credential Refresh Endpoint
CVE-2026-67622
FL
Flowise
FlowiseAI
9.9
0%
Aug 6Flowise 3.1.4 IDOR in OpenAI Assistants Integration
CVE-2026-67621
FL
Flowise
FlowiseAI
7.6
0%
Aug 6Flowise 3.1.4 Missing Authorization on Document Store Mutation Endpoints
CVE-2026-70478
FL
Flowise
FlowiseAI
10.0
1%
Aug 4Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service
CVE-2026-70477
FL
Flowise
FlowiseAI
9.8
1%
Aug 4Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
CVE-2026-70476
FL
Flowise
FlowiseAI
8.2
1%
Aug 4Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation
CVE-2026-70475
FL
Flowise
FlowiseAI
6.5
0%
Aug 4Flowise: Missing Authorization on Execution Update Endpoint
CVE-2026-70474
FL
Flowise
FlowiseAI
8.1
0%
Aug 4Flowise: Cross-Workspace OAuth2 Credential Metadata Leak
CVE-2026-70473
FL
Flowise
FlowiseAI
8.5
0%
Aug 4Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history
CVE-2026-70472
FL
Flowise
FlowiseAI
8.8
1%
Aug 4Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store
CVE-2026-70471
FL
Flowise
FlowiseAI
6.5
0%
Aug 4Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure
CVE-2026-70470
FL
Flowise
FlowiseAI
9.8
1%
Aug 4Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE
CVE-2026-69264
FL
Flowise
FlowiseAI
9.8
1%
Aug 4Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
CVE-2026-69263
FL
Flowise
FlowiseAI
9.8
1%
Aug 4Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)
CVE-2026-69262
FL
Flowise
FlowiseAI
8.1
1%
Aug 4Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type
CVE-2026-69259
FL
Flowise
FlowiseAI
8.8
1%
Aug 4Flowise RCE via SQLite Record Manager Node
CVE-2026-69258
FL
Flowise
FlowiseAI
9.1
1%
Aug 4Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API
CVE-2026-69257
FL
Flowise
FlowiseAI
8.6
0%
Aug 4Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses
CVE-2026-69256
FL
Flowise
FlowiseAI
8.8
1%
Aug 4Flowise: Remote Code Execution Vulnerability in CSVAgent
CVE-2026-69255
FL
Flowise
FlowiseAI
8.8
1%
Aug 4Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
CVE-2026-69254
FL
Flowise
FlowiseAI
8.8
1%
Aug 4Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
CVE-2026-69253
FL
Flowise
FlowiseAI
8.8
1%
Aug 4Flowise Sandbox Escape to RCE
CVE-2026-69252
FL
Flowise
FlowiseAI
8.8
1%
Aug 4Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization
CVE-2026-69251
FL
flowise-components
FlowiseAI
8.8
3%
Aug 4Flowise RCE via TypeORM DataSource
CVE-2026-69250
FL
Flowise
FlowiseAI
7.5
1%
Aug 4Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration
CVE-2026-56271
FL
Flowise
Flowiseai
9.8
1%
Jul 12Flowise - Weak Default JWT Secrets in Authentication Middleware
CVE-2026-56278
FL
Flowise
Flowiseai
9.1
1%
Jun 30Flowise - Session Hijacking via Weak Default Express Session Secret