Flowiseai vulnerabilities
120 CVEs and advisories name Flowiseai as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-41268Flowise: Flowise Parameter Override Bypass Remote Command Execution
- CVE-2026-41267Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association
- CVE-2026-41266Flowise: Sensitive Data Leak in public-chatbotConfig
- CVE-2026-41137Flowise: Code Injection in CSVAgent leads to Authenticated RCE
- CVE-2026-41138Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using Pandas.
- CVE-2026-40933Flowise: Authenticated RCE Via MCP Adapters
- CVE-2026-31829Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access
- CVE-2026-30824Flowise: Missing Authentication on NVIDIA NIM Endpoints
- CVE-2026-30823Flowise: IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration
- CVE-2026-30822Flowise: Mass Assignment in `/api/v1/leads` Endpoint
- CVE-2026-30821Flowise: Arbitrary File Upload via MIME Spoofing
- CVE-2026-30820Flowise Authorization Bypass via Spoofed x-request-from Header
- CVE-2025-34267Flowise Authenticated Command Execution and Sandbox Bypass via Puppeteer & Playwright Packages
- CVE-2025-61913Flowise is vulnerable to arbitrary file read, arbitrary file write
- CVE-2025-61687FlowiseAI/Flosise has File Upload vulnerability
- CVE-2025-50538Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log.
- CVE-2025-29192Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log.
- CVE-2025-59528Flowise has Remote Code Execution vulnerability
- CVE-2025-59527FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability
- CVE-2025-59434Critical Multi-Tenant Variable Disclosure in Flowise Cloud via Custom JavaScript Function
- CVE-2025-58434Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover
- CVE-2024-9148Flowise Stored Cross-Site Scripting
- CVE-2024-8181Flowise Authentication Bypass
- CVE-2024-8182Flowise Denial of Service
- CVE-2024-37146GHSL-2023-248: Flowise xss in /api/v1/credentials/id
- CVE-2024-37145GHSL-2023-247: Flowise xss in /api/v1/chatflows-streaming/id
- CVE-2024-36423GHSL-2023-246: Flowise xss in /api/v1/public-chatflows/id
- CVE-2024-36422GHSL-2023-245: Flowise xss in api/v1/chatflows/id
- CVE-2024-36421GHSL-2023-234: Flowise Cors Misconfiguration in packages/server/src/index.ts
- CVE-2024-36420GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-file