FL
Product
Flowise
25
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 9High 8Medium 8Low 0
Watch
Add Flowise to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-56267 | 6.9 | Jun 20 | Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint Affected: before 3.0.13 |
| CVE-2026-56273 | 6.5 | Jul 8 | Flowise - Path Traversal in Vector Store basePath Parameter Affected: before 3.1.0; before 3.1.0 |
| CVE-2026-56277 | 6.5 | Jun 30 | Flowise - Hardcoded CORS Wildcard in TTS Endpoint Affected: before 3.1.2 |
| CVE-2025-71331 | 6.1 | Jun 20 | Flowise - Cross-Site Scripting in Chat Messages and Agent Workflows Affected: before 3.0.8 |
| CVE-2026-56276 | 6.0 | Jun 20 | Flowise - Mass Assignment in PUT /api/v1/user Allows Password Hash Override Affected: before 3.1.2 |
| CVE-2026-58057 | 5.0 | Jun 28 | Flowise - Custom MCP Environment Variable Denylist Bypass via Case Sensitivity Affected: before 3.1.3 |
| CVE-2026-56269 | 4.6 | Jun 24 | Flowise - Weak Default Token Hash Secret in JWT Token Encryption Affected: before 3.1.0 |
| CVE-2026-56272 | 4.1 | Jun 24 | Flowise - Insufficient Password Salt Rounds in Bcrypt Hashing Affected: before 3.0.13 |
Showing 8