CVE-2026-56271 | Critical | 9.8 | 2026-07-12 | Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and is… |
CVE-2026-56273 | Medium | 6.5 | 2026-07-08 | Flowise before 3.1.0 contains a path traversal vulnerability in Faiss and SimpleStore vector store implementations that accept unsanitized basePath parameters… |
CVE-2026-56278 | Critical | 9.1 | 2026-06-30 | Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the express-session middleware when the EXPRES… |
CVE-2026-56277 | Medium | 6.5 | 2026-06-30 | Flowise before 3.1.2 sets Access-Control-Allow-Origin to a hardcoded wildcard (*) on its text-to-speech (TTS) generation endpoint (packages/server/src/controll… |
CVE-2026-58057 | Medium | 5.0 | 2026-06-28 | Flowise before 3.1.3 validates Custom MCP stdio environment variables against a denylist using a case-sensitive comparison, so on Windows, where environment na… |
CVE-2025-71338 | Critical | 10.0 | 2026-06-25 | Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoint that allows unauthenticated attackers to write arbitrary… |
CVE-2025-71336 | Critical | 9.8 | 2026-06-25 | Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, which… |
CVE-2025-71335 | High | 8.1 | 2026-06-25 | Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An at… |
CVE-2025-71334 | Critical | 9.8 | 2026-06-25 | Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that the chatflowId and ch… |
CVE-2025-71333 | Critical | 9.8 | 2026-06-25 | Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Att… |
CVE-2025-71328 | High | 8.3 | 2026-06-25 | Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their account password through the account setting… |
CVE-2025-71327 | Critical | 9.1 | 2026-06-25 | Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create us… |
CVE-2025-71324 | High | 7.5 | 2026-06-25 | Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/do… |
CVE-2026-56272 | Medium | 4.1 | 2026-06-24 | Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32 iterations instead of the OWASP-recommended minimum of 10 rounds. Attackers… |
CVE-2026-56270 | High | 7.5 | 2026-06-24 | Flowise before 3.1.0 (versions 3.0.13 and earlier) contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint that allows unauthentica… |
CVE-2026-56269 | Medium | 4.6 | 2026-06-24 | Flowise before 3.1.0 (npm package flowise, versions 3.0.13 and earlier) uses a weak hardcoded default value 'Secre$t' for the TOKEN_HASH_SECRET environment var… |
CVE-2025-71332 | Medium | 6.5 | 2026-06-24 | Flowise through 2.2.7 contains a SQL injection vulnerability in the importChatflows API. Due to insufficient validation of the chatflow.id value, an authentica… |
CVE-2026-56275 | High | 7.1 | 2026-06-23 | Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by provi… |
CVE-2026-56274 | Critical | 9.9 | 2026-06-23 | Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server feature due to incomplete command-flag validation and a re… |
CVE-2025-71337 | High | 8.3 | 2026-06-23 | Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. An authenticated user can change the account ema… |
CVE-2026-56268 | High | 7.7 | 2026-06-22 | Flowise before 3.1.2 contains an information disclosure vulnerability in the /api/v1/chatflows/apikey/:apikey endpoint. When the keyonly query parameter is omi… |
CVE-2026-56276 | | | 2026-06-20 | Flowise before 3.1.2 contains a mass assignment vulnerability in the PUT /api/v1/user endpoint that allows authenticated users to directly modify the credentia… |
CVE-2026-56267 | | | 2026-06-20 | Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects includ… |
CVE-2025-71331 | Medium | 6.1 | 2026-06-20 | Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom agent functions. An… |
CVE-2024-58351 | Critical | 9.8 | 2026-06-20 | Flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the overrideConfig option, supported in both the frontend web… |