Vulnerabilities in FlowiseAI
120 resultsCVE-2024-37146MEDIUMGHSL-2023-248: Flowise xss in /api/v1/credentials/idEPSS 0.4%CVE-2026-91930HIGHFlowise before 3.1.4 Cross-Tenant Organization Admin TakeoverEPSS 0.4%CVE-2026-8028MEDIUMFlowiseAI Flowise Endpoint account.service.ts verify information disclosureEPSS 0.4%CVE-2026-43995MEDIUMFlowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)EPSS 0.4%CVE-2026-91935HIGHFlowise before 3.1.4 SSRF and API Key Exfiltration via Chat Model NodesEPSS 0.4%CVE-2026-91938HIGHFlowise before 3.1.4 Server-Side Request Forgery via document loadersEPSS 0.4%CVE-2026-73488MEDIUMFlowise before 3.1.3 IDOR via customer-default-source endpointEPSS 0.4%CVE-2026-90534MEDIUMFlowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-methodEPSS 0.4%CVE-2026-100607CRITICALFlowise through 3.1.4 Authentication Bypass via Email-Only SSOEPSS 0.4%CVE-2026-91933HIGHFlowise before 3.1.4 Authorization Bypass via openai-realtimeEPSS 0.4%CVE-2026-91929HIGHFlowise before 3.1.4 Cross-Tenant Authorization BypassEPSS 0.4%CVE-2026-100608HIGHFlowise through 3.1.4 Authorization Bypass via BullMQ DashboardEPSS 0.3%CVE-2026-100610HIGHFlowise through 3.1.4 Missing Authorization via upsert-historyEPSS 0.3%CVE-2026-46478HIGHFlowise: DatasetRow create+update mass-assignment allows cross-workspace row takeoverEPSS 0.3%CVE-2026-119978CRITICALFlowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStoreEPSS 0.3%CVE-2026-46479HIGHFlowise: Evaluation create+update mass-assignment allows cross-workspace evaluation takeoverEPSS 0.3%CVE-2026-46475HIGHFlowise: Assistant create+update mass-assignment allows cross-workspace assistant takeoverEPSS 0.3%CVE-2026-46480HIGHFlowise: Evaluator create+update mass-assignment allows cross-workspace evaluator takeoverEPSS 0.3%CVE-2026-90533MEDIUMFlowise before 3.1.4 Broken Access Control via organizationuserEPSS 0.3%CVE-2026-46477HIGHFlowise: Dataset create+update mass-assignment allows cross-workspace dataset takeoverEPSS 0.3%