Vulnerabilities in FlowiseAI

113 results
Vexday analysis

Com 62 CVEs catalogadas e 38 surgidas apenas nos últimos 90 dias, o FlowiseAI apresenta um ritmo de descoberta de vulnerabilidades consideravelmente acelerado, o que exige atenção contínua de equipes de segurança. Nenhuma das falhas consta atualmente no catálogo KEV da CISA — taxa abaixo da média geral do catálogo —, porém isso não reduz o risco potencial: o CVE-2025-59528 registra um score EPSS de 0,9018, indicando altíssima probabilidade de exploração em ambiente real segundo os modelos preditivos. Das 62 vulnerabilidades, 12 são classificadas como críticas e 3 possuem prova de conceito pública, ampliando a superfície de ataque para agentes mal-intencionados. O tipo de falha mais frequente é CWE-915 (modificação indevida de atributos de objetos de massa), padrão que frequentemente viabiliza bypass de controles de acesso e manipulação de dados sensíveis em aplicações orientadas a fluxos de IA.

CVE-2024-36422MEDIUMGHSL-2023-245: Flowise xss in api/v1/chatflows/idEPSS 0.4%CVE-2024-36423MEDIUMGHSL-2023-246: Flowise xss in /api/v1/public-chatflows/idEPSS 0.4%CVE-2024-37146MEDIUMGHSL-2023-248: Flowise xss in /api/v1/credentials/idEPSS 0.4%CVE-2026-8028MEDIUMFlowiseAI Flowise Endpoint account.service.ts verify information disclosureEPSS 0.4%CVE-2026-69250HIGHFlowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret ExfiltrationEPSS 0.4%CVE-2026-43995MEDIUMFlowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)EPSS 0.4%CVE-2026-91930HIGHFlowise before 3.1.4 Cross-Tenant Organization Admin TakeoverEPSS 0.4%CVE-2026-73604HIGHFlowise before 3.1.3 Credential Exposure via APIEPSS 0.4%CVE-2026-69252HIGHFlowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organizationEPSS 0.4%CVE-2026-91936HIGHFlowise before 3.1.4 Script Injection via Docker WorkflowsEPSS 0.3%CVE-2026-91938HIGHFlowise before 3.1.4 Server-Side Request Forgery via document loadersEPSS 0.3%CVE-2026-67621HIGHFlowise 3.1.4 Missing Authorization on Document Store Mutation EndpointsEPSS 0.3%CVE-2026-46478HIGHFlowise: DatasetRow create+update mass-assignment allows cross-workspace row takeoverEPSS 0.3%CVE-2026-73603MEDIUMFlowise before 3.1.4 Credential Abuse via Text-to-SpeechEPSS 0.3%CVE-2026-70472HIGHFlowise: Cross-workspace credential IDOR in openai-assistants-vector-storeEPSS 0.3%CVE-2026-46477HIGHFlowise: Dataset create+update mass-assignment allows cross-workspace dataset takeoverEPSS 0.3%CVE-2026-46479HIGHFlowise: Evaluation create+update mass-assignment allows cross-workspace evaluation takeoverEPSS 0.3%CVE-2026-46475HIGHFlowise: Assistant create+update mass-assignment allows cross-workspace assistant takeoverEPSS 0.3%CVE-2026-46476HIGHFlowise: CustomTemplate create+update mass-assignment allows cross-workspace template takeoverEPSS 0.3%CVE-2026-46480HIGHFlowise: Evaluator create+update mass-assignment allows cross-workspace evaluator takeoverEPSS 0.3%