FlowiseAI Flowise

• CVE-2026-30821 High 8.2 Flowise: Arbitrary File Upload via MIME Spoofing 16.7%
• CVE-2026-30820 High 8.7 Flowise Authorization Bypass via Spoofed x-request-from Header 0.5%
• CVE-2025-34267 High 8.4 Flowise Authenticated Command Execution and Sandbox Bypass via Puppeteer & Playwright Packages 6.9%
• CVE-2025-61913 Critical 10.0 Flowise is vulnerable to arbitrary file read, arbitrary file write 13.9%
• CVE-2025-61687 High 8.3 FlowiseAI/Flosise has File Upload vulnerability 11.8%
• CVE-2025-29192 High 8.2 Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log. 0.4%
• CVE-2025-50538 High 8.2 Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log. 14.7%
• CVE-2025-59528 Critical 10.0 Flowise has Remote Code Execution vulnerability 86.5%
• CVE-2025-59527 High 7.5 FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability 5.5%
• CVE-2025-59434 Critical 9.6 Critical Multi-Tenant Variable Disclosure in Flowise Cloud via Custom JavaScript Function 4.0%
• CVE-2025-58434 Critical 9.8 Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover 82.6%
• CVE-2024-8181 Critical 9.8 Flowise Authentication Bypass 45.1%
• CVE-2024-8182 High 7.5 Flowise Denial of Service 13.9%
• CVE-2024-37146 Medium 6.1 GHSL-2023-248: Flowise xss in /api/v1/credentials/id 0.4%
• CVE-2024-37145 Medium 6.1 GHSL-2023-247: Flowise xss in /api/v1/chatflows-streaming/id 0.5%
• CVE-2024-36423 Medium 6.1 GHSL-2023-246: Flowise xss in /api/v1/public-chatflows/id 0.4%
• CVE-2024-36422 Medium 6.1 GHSL-2023-245: Flowise xss in api/v1/chatflows/id 0.4%
• CVE-2024-36421 High 7.5 GHSL-2023-234: Flowise Cors Misconfiguration in packages/server/src/index.ts 8.5%
• CVE-2024-36420 High 7.5 GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-file 1.8%