FFlowiseAI

Products

Exploited and recent CVEs

• CVE-2026-119978 High 8.5 Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore 0.3%
• CVE-2026-100610 High 7.5 Flowise through 3.1.4 Missing Authorization via upsert-history 0.3%
• CVE-2026-100609 Medium 6.8 Flowise through 3.1.4 Insecure Direct Object Reference via Credential 0.3%
• CVE-2026-100608 High 8.3 Flowise through 3.1.4 Authorization Bypass via BullMQ Dashboard 0.3%
• CVE-2026-100607 High 7.7 Flowise through 3.1.4 Authentication Bypass via Email-Only SSO 0.4%
• CVE-2026-100606 High 7.7 Flowise through 3.1.4 Authentication Bypass via SSO Email Match 0.5%
• CVE-2026-100605 High 7.1 Flowise through 3.1.4 Missing Authorization via Chat Message Routes 0.3%
• CVE-2026-91938 High 7.1 Flowise before 3.1.4 Server-Side Request Forgery via document loaders 0.4%
• CVE-2026-91937 High 7.5 Flowise before 3.1.4 NoSQL Injection via sessionId 0.5%
• CVE-2026-91936 Medium 6.8 Flowise before 3.1.4 Script Injection via Docker Workflows 0.5%
• CVE-2026-91935 High 8.3 Flowise before 3.1.4 SSRF and API Key Exfiltration via Chat Model Nodes 0.4%
• CVE-2026-91934 High 8.8 Flowise before 3.1.4 Remote Code Execution via SQL Database Chain 0.7%
• CVE-2026-91933 High 7.1 Flowise before 3.1.4 Authorization Bypass via openai-realtime 0.4%
• CVE-2026-91932 High 8.5 Flowise before 3.1.4 Remote Code Execution via cwd Parameter 0.7%
• CVE-2026-91931 High 8.5 Flowise before 3.1.4 Remote Code Execution via Custom MCP npx 0.7%
• CVE-2026-91930 High 7.5 Flowise before 3.1.4 Cross-Tenant Organization Admin Takeover 0.4%
• CVE-2026-91929 High 7.1 Flowise before 3.1.4 Cross-Tenant Authorization Bypass 0.4%
• CVE-2026-90580 Medium 6.3 FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery 0.4%
• CVE-2026-90535 Medium 6.3 Flowise before 3.1.4 Denial of Service via text-to-speech/abort 0.5%
• CVE-2026-90534 Medium 6.1 Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method 0.4%
• CVE-2026-90533 Medium 6.0 Flowise before 3.1.4 Broken Access Control via organizationuser 0.3%
• CVE-2026-73604 Medium 6.5 Flowise before 3.1.3 Credential Exposure via API 0.4%
• CVE-2026-73603 Medium 6.3 Flowise before 3.1.4 Credential Abuse via Text-to-Speech 0.3%
• CVE-2026-73602 Critical 9.0 Flowise before 3.1.3 Sandbox Escape to RCE 0.8%
• CVE-2026-73601 Critical 9.0 Flowise before 3.1.3 Remote Code Execution via Custom MCP 1.1%
• CVE-2026-73488 Medium 6.0 Flowise before 3.1.3 IDOR via customer-default-source endpoint 0.4%
• CVE-2026-73487 Critical 9.0 Flowise before 3.1.3 Prompt Injection RCE via CSV Agent 1.0%
• CVE-2026-73486 Critical 9.0 Flowise before 3.1.3 Code Injection via CSV Agent customReadCSV 0.7%
• CVE-2026-73485 Critical 9.0 Flowise before 3.1.3 Remote Code Execution via Airtable Agent 0.6%
• CVE-2026-73484 High 8.6 Flowise before 3.1.3 Sandbox Escape via Pandas Methods 0.4%