What’s Vulnerable › Products

FlowiseAI Flowise vulnerabilities

150 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 140 published in the last 12 months.

Check whether your FlowiseAI Flowise version is affected

Latest FlowiseAI Flowise vulnerabilities

• CVE-2026-100610 — Flowise through 3.1.4 Missing Authorization via upsert-history (CVSS 7.5)
• CVE-2026-100609 — Flowise through 3.1.4 Insecure Direct Object Reference via Credential (CVSS 6.8)
• CVE-2026-100608 — Flowise through 3.1.4 Authorization Bypass via BullMQ Dashboard (CVSS 8.3)
• CVE-2026-100607 — Flowise through 3.1.4 Authentication Bypass via Email-Only SSO (CVSS 7.7)
• CVE-2026-100606 — Flowise through 3.1.4 Authentication Bypass via SSO Email Match (CVSS 7.7)
• CVE-2026-100605 — Flowise through 3.1.4 Missing Authorization via Chat Message Routes (CVSS 7.1)
• CVE-2026-91938 — Flowise before 3.1.4 Server-Side Request Forgery via document loaders (CVSS 7.1)
• CVE-2026-91937 — Flowise before 3.1.4 NoSQL Injection via sessionId (CVSS 7.5)
• CVE-2026-91936 — Flowise before 3.1.4 Script Injection via Docker Workflows (CVSS 6.8)
• CVE-2026-91935 — Flowise before 3.1.4 SSRF and API Key Exfiltration via Chat Model Nodes (CVSS 8.3)
• CVE-2026-91934 — Flowise before 3.1.4 Remote Code Execution via SQL Database Chain (CVSS 8.8)
• CVE-2026-91933 — Flowise before 3.1.4 Authorization Bypass via openai-realtime (CVSS 7.1)
• CVE-2026-91932 — Flowise before 3.1.4 Remote Code Execution via cwd Parameter (CVSS 8.5)
• CVE-2026-91931 — Flowise before 3.1.4 Remote Code Execution via Custom MCP npx (CVSS 8.5)
• CVE-2026-91930 — Flowise before 3.1.4 Cross-Tenant Organization Admin Takeover (CVSS 7.5)
• CVE-2026-91929 — Flowise before 3.1.4 Cross-Tenant Authorization Bypass (CVSS 7.1)
• CVE-2026-90580 — FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery (CVSS 6.3)
• CVE-2026-90535 — Flowise before 3.1.4 Denial of Service via text-to-speech/abort (CVSS 7.5)
• CVE-2026-90534 — Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method (CVSS 6.5)
• CVE-2026-90533 — Flowise before 3.1.4 Broken Access Control via organizationuser (CVSS 6.5)
• CVE-2026-52098 — (CVSS 9.8)
• CVE-2026-73604 — Flowise before 3.1.3 Credential Exposure via API (CVSS 6.5)
• CVE-2026-73603 — Flowise before 3.1.4 Credential Abuse via Text-to-Speech (CVSS 5.3)
• CVE-2026-73602 — Flowise before 3.1.3 Sandbox Escape to RCE (CVSS 9.9)
• CVE-2026-73601 — Flowise before 3.1.3 Remote Code Execution via Custom MCP (CVSS 8.8)