FFlowise

Products

Exploited and recent CVEs

• CVE-2026-56271 Critical 9.8 Flowise - Weak Default JWT Secrets in Authentication Middleware 0.7%
• CVE-2026-56273 Medium 6.5 Flowise - Path Traversal in Vector Store basePath Parameter 0.5%
• CVE-2026-56278 Critical 9.1 Flowise - Session Hijacking via Weak Default Express Session Secret 0.5%
• CVE-2026-56277 Medium 6.9 Flowise - Hardcoded CORS Wildcard in TTS Endpoint 0.2%
• CVE-2026-58057 Medium 5.0 Flowise - Custom MCP Environment Variable Denylist Bypass via Case Sensitivity 1.6%
• CVE-2025-71338 Critical 10.0 Flowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store API 1.2%
• CVE-2025-71336 Critical 9.8 Flowise - Unsandboxed Remote Code Execution via Custom MCP 1.1%
• CVE-2025-71335 High 8.1 Flowise - Session Invalidation Failure After Password Change 0.4%
• CVE-2025-71334 Critical 9.8 Flowise - Arbitrary File Access via Missing Chat Flow ID Validation 4.4%
• CVE-2025-71333 Critical 9.3 Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint 0.9%
• CVE-2025-71328 High 8.3 Flowise - Unverified Password Change via Account Settings 0.5%
• CVE-2025-71327 Critical 9.1 Flowise - Authentication Bypass via Unprotected Registration Endpoint 0.7%
• CVE-2025-71324 High 7.5 Flowise - Arbitrary File Read via chatId Parameter 1.6%
• CVE-2026-56272 Medium 4.1 Flowise - Insufficient Password Salt Rounds in Bcrypt Hashing <0.1%
• CVE-2026-56270 High 7.5 Flowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint 2.0%
• CVE-2026-56269 Medium 4.6 Flowise - Weak Default Token Hash Secret in JWT Token Encryption 0.1%
• CVE-2025-71332 Medium 6.5 Flowise - SQL Injection in importChatflows API via chatflow.id Parameter 0.5%
• CVE-2026-56275 Medium 6.0 Flowise - Server-Side Request Forgery via Execute Flow Base URL 0.3%
• CVE-2026-56274 Critical 9.9 Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess 7.5%
• CVE-2026-56274 Critical 9.9 Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess 7.5%
• CVE-2025-71337 High 8.3 Flowise - Unverified Email Change via Account Profile Endpoint 0.4%
• CVE-2026-56268 High 7.7 Flowise - Cross-Workspace Information Disclosure via chatflows/apikey Endpoint 0.4%
• CVE-2026-56276 Medium 6.0 Flowise - Mass Assignment in PUT /api/v1/user Allows Password Hash Override 0.4%
• CVE-2026-56267 Medium 6.9 Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint 0.5%
• CVE-2025-71331 Medium 6.1 Flowise - Cross-Site Scripting in Chat Messages and Agent Workflows 0.3%
• CVE-2024-58351 Critical 9.8 Flowise - Remote Code Execution via overrideConfig Parameter 0.7%