# cve.now: Flowise

The newest entries naming Flowise as an affected vendor (up to 200), of 25 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-56271](https://cve.now/CVE-2026-56271.md): Flowise - Weak Default JWT Secrets in Authentication Middleware (CVSS 9.3)
- [CVE-2026-56273](https://cve.now/CVE-2026-56273.md): Flowise - Path Traversal in Vector Store basePath Parameter (CVSS 4.9)
- [CVE-2026-56278](https://cve.now/CVE-2026-56278.md): Flowise - Session Hijacking via Weak Default Express Session Secret (CVSS 9.3)
- [CVE-2026-56277](https://cve.now/CVE-2026-56277.md): Flowise - Hardcoded CORS Wildcard in TTS Endpoint (CVSS 6.9)
- [CVE-2026-58057](https://cve.now/CVE-2026-58057.md): Flowise - Custom MCP Environment Variable Denylist Bypass via Case Sensitivity (CVSS 5.0)
- [CVE-2025-71338](https://cve.now/CVE-2025-71338.md): Flowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store API (CVSS 10.0)
- [CVE-2025-71336](https://cve.now/CVE-2025-71336.md): Flowise - Unsandboxed Remote Code Execution via Custom MCP (CVSS 9.3)
- [CVE-2025-71335](https://cve.now/CVE-2025-71335.md): Flowise - Session Invalidation Failure After Password Change (CVSS 8.6)
- [CVE-2025-71334](https://cve.now/CVE-2025-71334.md): Flowise - Arbitrary File Access via Missing Chat Flow ID Validation (CVSS 9.3)
- [CVE-2025-71333](https://cve.now/CVE-2025-71333.md): Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint (CVSS 9.3)
- [CVE-2025-71328](https://cve.now/CVE-2025-71328.md): Flowise - Unverified Password Change via Account Settings (CVSS 8.7)
- [CVE-2025-71327](https://cve.now/CVE-2025-71327.md): Flowise - Authentication Bypass via Unprotected Registration Endpoint (CVSS 9.3)
- [CVE-2025-71324](https://cve.now/CVE-2025-71324.md): Flowise - Arbitrary File Read via chatId Parameter (CVSS 8.7)
- [CVE-2026-56272](https://cve.now/CVE-2026-56272.md): Flowise - Insufficient Password Salt Rounds in Bcrypt Hashing (CVSS 5.6)
- [CVE-2026-56270](https://cve.now/CVE-2026-56270.md): Flowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint (CVSS 8.7)
- [CVE-2026-56269](https://cve.now/CVE-2026-56269.md): Flowise - Weak Default Token Hash Secret in JWT Token Encryption (CVSS 4.3)
- [CVE-2025-71332](https://cve.now/CVE-2025-71332.md): Flowise - SQL Injection in importChatflows API via chatflow.id Parameter (CVSS 8.5)
- [CVE-2026-56275](https://cve.now/CVE-2026-56275.md): Flowise - Server-Side Request Forgery via Execute Flow Base URL (CVSS 6.0)
- [CVE-2026-56274](https://cve.now/CVE-2026-56274.md): Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess (CVSS 8.7)
- [CVE-2025-71337](https://cve.now/CVE-2025-71337.md): Flowise - Unverified Email Change via Account Profile Endpoint (CVSS 8.7)
- [CVE-2026-56268](https://cve.now/CVE-2026-56268.md): Flowise - Cross-Workspace Information Disclosure via chatflows/apikey Endpoint (CVSS 5.3)
- [CVE-2026-56276](https://cve.now/CVE-2026-56276.md): Flowise - Mass Assignment in PUT /api/v1/user Allows Password Hash Override (CVSS 6.0)
- [CVE-2026-56267](https://cve.now/CVE-2026-56267.md): Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint (CVSS 6.9)
- [CVE-2025-71331](https://cve.now/CVE-2025-71331.md): Flowise - Cross-Site Scripting in Chat Messages and Agent Workflows (CVSS 5.1)
- [CVE-2024-58351](https://cve.now/CVE-2024-58351.md): Flowise - Remote Code Execution via overrideConfig Parameter (CVSS 9.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/flowise
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.