Flowiseai vulnerabilities
120 CVEs and advisories name Flowiseai as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-119978Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore
- CVE-2026-100610Flowise through 3.1.4 Missing Authorization via upsert-history
- CVE-2026-100609Flowise through 3.1.4 Insecure Direct Object Reference via Credential
- CVE-2026-100608Flowise through 3.1.4 Authorization Bypass via BullMQ Dashboard
- CVE-2026-100607Flowise through 3.1.4 Authentication Bypass via Email-Only SSO
- CVE-2026-100606Flowise through 3.1.4 Authentication Bypass via SSO Email Match
- CVE-2026-100605Flowise through 3.1.4 Missing Authorization via Chat Message Routes
- CVE-2026-91938Flowise before 3.1.4 Server-Side Request Forgery via document loaders
- CVE-2026-91937Flowise before 3.1.4 NoSQL Injection via sessionId
- CVE-2026-91936Flowise before 3.1.4 Script Injection via Docker Workflows
- CVE-2026-91935Flowise before 3.1.4 SSRF and API Key Exfiltration via Chat Model Nodes
- CVE-2026-91934Flowise before 3.1.4 Remote Code Execution via SQL Database Chain
- CVE-2026-91933Flowise before 3.1.4 Authorization Bypass via openai-realtime
- CVE-2026-91932Flowise before 3.1.4 Remote Code Execution via cwd Parameter
- CVE-2026-91931Flowise before 3.1.4 Remote Code Execution via Custom MCP npx
- CVE-2026-91930Flowise before 3.1.4 Cross-Tenant Organization Admin Takeover
- CVE-2026-91929Flowise before 3.1.4 Cross-Tenant Authorization Bypass
- CVE-2026-90580FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery
- CVE-2026-90535Flowise before 3.1.4 Denial of Service via text-to-speech/abort
- CVE-2026-90534Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method
- CVE-2026-90533Flowise before 3.1.4 Broken Access Control via organizationuser
- CVE-2026-73604Flowise before 3.1.3 Credential Exposure via API
- CVE-2026-73603Flowise before 3.1.4 Credential Abuse via Text-to-Speech
- CVE-2026-73602Flowise before 3.1.3 Sandbox Escape to RCE
- CVE-2026-73601Flowise before 3.1.3 Remote Code Execution via Custom MCP
- CVE-2026-73488Flowise before 3.1.3 IDOR via customer-default-source endpoint
- CVE-2026-73487Flowise before 3.1.3 Prompt Injection RCE via CSV Agent
- CVE-2026-73486Flowise before 3.1.3 Code Injection via CSV Agent customReadCSV
- CVE-2026-73485Flowise before 3.1.3 Remote Code Execution via Airtable Agent
- CVE-2026-73484Flowise before 3.1.3 Sandbox Escape via Pandas Methods