| FlowiseDB vulnerable to SQL Injection by authenticated usersCVE-2025-71332 · GHSA-9C4C-G95M-C8CP |
flowise |
npm |
High
|
No fix reported |
|
| Flowise allows arbitrary file write to RCECVE-2025-71338 · GHSA-8VVX-QVQ9-5948 |
flowise |
npm |
Critical
|
No fix reported |
|
| Flowise has unsandboxed remote code execution via Custom MCPCVE-2025-71336 · GHSA-6933-JPX5-Q87Q |
flowise |
npm |
Critical
|
Fix reported |
|
| Flowise has arbitrary file access due to missing chat flow id validationCVE-2025-71334 · GHSA-Q67Q-549Q-P849 |
flowise |
npm |
Critical
|
Fix reported |
|
| Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator BypassCVE-2026-73487 · GHSA-W7X8-Q2GP-5CGG |
flowise-componentsflowise |
npm |
Critical
|
Fix reported |
|
| Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via ChromiumCVE-2026-73483 · GHSA-9GVV-QJJ3-2P6G |
flowise-componentsflowise |
npm |
Critical
|
Fix reported |
|
| Flowise Execute Flow function has an SSRF vulnerabilityCVE-2026-56275 · GHSA-9HRV-GVRV-6GF2 |
flowise-componentsflowise |
npm |
Medium
|
Fix reported |
|
| Flowise OverrideConfig security vulnerabilityCVE-2024-58351 · GHSA-5CPH-WVM9-45GJ |
flowise |
npm |
High
|
Fix reported |
|
| Flowise: Incomplete Credential Redaction Exposes Secrets via APICVE-2026-73604 · GHSA-RWRP-9823-P2XQ |
flowise |
npm |
Medium
|
Fix reported |
|
| Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 AddressesCVE-2026-69257 · GHSA-C6XH-WV4J-PPV5 |
flowise |
npm |
High
|
Fix reported |
|
| Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpointCVE-2026-73488 · GHSA-2364-JH4Q-M9VM |
flowise |
npm |
Medium
|
Fix reported |
|
| Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS CredentialsCVE-2026-73603 · GHSA-8GJ2-2CVC-6XX7 |
flowise |
npm |
Medium
|
Fix reported |
|
| Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected serviceCVE-2026-70478 · GHSA-QGVM-J2HM-6M38 |
flowise |
npm |
Critical
|
Fix reported |
|
| Flowise: CSV Agent Prompt Injection Remote Code Execution VulnerabilityCVE-2026-70477 · GHSA-5XVG-PMGG-3MXR |
flowise-componentsflowise |
npm |
Critical
|
Fix reported |
|
| Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing ManipulationCVE-2026-70476 · GHSA-GMMW-QG98-6J6P |
flowise |
npm |
High
|
Fix reported |
|
| Flowise: Missing Authorization on Execution Update EndpointCVE-2026-70475 · GHSA-FM2F-4339-4P2F |
flowise |
npm |
High
|
Fix reported |
|
| Flowise: Cross-Workspace OAuth2 Credential Metadata LeakCVE-2026-70474 · GHSA-WCH5-XP77-FXG4 |
flowise |
npm |
High
|
Fix reported |
|
| Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert historyCVE-2026-70473 · GHSA-FR6G-7CQ8-FG82 |
flowise |
npm |
High
|
Fix reported |
|
| Flowise: Cross-workspace credential IDOR in openai-assistants-vector-storeCVE-2026-70472 · GHSA-CHM3-VQCF-52RX |
flowise |
npm |
High
|
Fix reported |
|
| Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables DisclosureCVE-2026-70471 · GHSA-8R8H-6VCC-XHRV |
flowise |
npm |
High
|
Fix reported |
|
