FL
Product
Flowise
146
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 39High 78Medium 28Low 1
Watch
Add Flowise to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-100609 | 6.8 | Sep 26 | Flowise through 3.1.4 Insecure Direct Object Reference via Credential Affected: through 3.1.4; through 3.1.4 |
| CVE-2026-91936 | 6.8 | Sep 15 | Flowise before 3.1.4 Script Injection via Docker Workflows Affected: before 3.1.4 |
| CVE-2026-90534 | 6.5 | Sep 12 | Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method Affected: before 3.1.4 |
| CVE-2026-90533 | 6.5 | Sep 12 | Flowise before 3.1.4 Broken Access Control via organizationuser Affected: before 3.1.4 |
| CVE-2026-73604 | 6.5 | Aug 13 | Flowise before 3.1.3 Credential Exposure via API Affected: before 3.1.3 |
| CVE-2026-73488 | 6.5 | Aug 13 | Flowise before 3.1.3 IDOR via customer-default-source endpoint Affected: before 3.1.3 |
| CVE-2026-70475 | 6.5 | Aug 4 | Flowise: Missing Authorization on Execution Update Endpoint Affected: < 3.1.2 |
| CVE-2026-70471 | 6.5 | Aug 4 | Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure Affected: < 3.1.3 |
| CVE-2026-56277 | 6.5 | Jun 30 | Flowise - Hardcoded CORS Wildcard in TTS Endpoint Affected: before 3.1.2 |
| CVE-2026-46443 | 6.5 | Jun 8 | Flowise: Credential Data Leak Affected: < 3.1.2 |
| CVE-2025-57164 | 6.5 | Oct 17 | Flowise through v3.0.4 is vulnerable to remote code execution via unsanitized evaluation of user input in the "Supabase RPC Filter" field Affected: 3.0.5 |
| CVE-2026-90580 | 6.3 | Sep 13 | FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery Affected: 3.0.0; 3.0.1; 3.0.2 |
| CVE-2026-12821 | 6.3 | Jun 21 | FlowiseAI Flowise S3 Document Loader S3.ts path traversal Affected: 3.1.0; 3.1.1; 3.1.2 |
| CVE-2025-71331 | 6.1 | Jun 20 | Flowise - Cross-Site Scripting in Chat Messages and Agent Workflows Affected: before 3.0.8 |
| CVE-2025-50538 | 6.1 | Oct 6 | Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log Affected: before 3.0.5 |
| CVE-2025-29192 | 6.1 | Oct 6 | Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log Affected: before 3.0.5 |
| CVE-2024-9148 | 6.1 | Sep 24 | Flowise Stored Cross-Site Scripting Affected: before 2.1.1 |
| CVE-2024-37146 | 6.1 | Jul 1 | GHSL-2023-248: Flowise xss in /api/v1/credentials/id Affected: <= 1.4.3 |
| CVE-2024-37145 | 6.1 | Jul 1 | GHSL-2023-247: Flowise xss in /api/v1/chatflows-streaming/id Affected: <= 1.4.3 |
| CVE-2024-36423 | 6.1 | Jul 1 | GHSL-2023-246: Flowise xss in /api/v1/public-chatflows/id Affected: <= 1.4.3 |
| CVE-2024-36422 | 6.1 | Jul 1 | GHSL-2023-245: Flowise xss in api/v1/chatflows/id Affected: <= 1.4.3 |
| CVE-2026-73603 | 5.3 | Aug 13 | Flowise before 3.1.4 Credential Abuse via Text-to-Speech Affected: before 3.1.4 |
| CVE-2026-8026 | 5.3 | May 6 | FlowiseAI Flowise API Response account.service.ts login information disclosure Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; 3.0.5; +7 more |
| CVE-2026-58057 | 5.0 | Jun 28 | Flowise - Custom MCP Environment Variable Denylist Bypass via Case Sensitivity Affected: before 3.1.3 |
| CVE-2026-42862 | 5.0 | Jun 8 | Flowise: Mass Assignment in Tool Update Endpoint Allows Cross-Workspace Resource Reassignment Affected: < 3.1.2 |
| CVE-2026-56269 | 4.6 | Jun 24 | Flowise - Weak Default Token Hash Secret in JWT Token Encryption Affected: before 3.1.0 |
| CVE-2026-8027 | 4.3 | May 6 | FlowiseAI Flowise User Controller authorization Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; 3.0.5; +7 more |
| CVE-2026-56272 | 4.1 | Jun 24 | Flowise - Insufficient Password Salt Rounds in Bcrypt Hashing Affected: before 3.0.13 |
Showing 28