Vulnerabilidades en FlowiseAI
120 resultadosCVE-2026-70474HIGHFlowise: Cross-Workspace OAuth2 Credential Metadata LeakEPSS 0.5%CVE-2026-41269HIGHFlowise: File Upload Validation Bypass in createAttachmentEPSS 0.5%CVE-2026-100606CRITICALFlowise through 3.1.4 Authentication Bypass via SSO Email MatchEPSS 0.5%CVE-2026-91937HIGHFlowise before 3.1.4 NoSQL Injection via sessionIdEPSS 0.5%CVE-2026-30823HIGHFlowise: IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO ConfigurationEPSS 0.5%CVE-2026-67620MEDIUMFlowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-ListEPSS 0.5%CVE-2026-91936HIGHFlowise before 3.1.4 Script Injection via Docker WorkflowsEPSS 0.5%CVE-2024-37145MEDIUMGHSL-2023-247: Flowise xss in /api/v1/chatflows-streaming/idEPSS 0.5%CVE-2026-70475HIGHFlowise: Missing Authorization on Execution Update EndpointEPSS 0.5%CVE-2026-70473HIGHFlowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert historyEPSS 0.5%CVE-2026-73484HIGHFlowise before 3.1.3 Sandbox Escape via Pandas MethodsEPSS 0.4%CVE-2026-69257HIGHFlowise: SSRF Protection Bypass via IPv4-Mapped IPv6 AddressesEPSS 0.4%CVE-2026-41278HIGHFlowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDsEPSS 0.4%CVE-2026-67621HIGHFlowise 3.1.4 Missing Authorization on Document Store Mutation EndpointsEPSS 0.4%CVE-2026-73604HIGHFlowise before 3.1.3 Credential Exposure via APIEPSS 0.4%CVE-2026-70471HIGHFlowise: RBAC Bypass Leading to Unauthorized Workspace Variables DisclosureEPSS 0.4%CVE-2025-29192HIGHFlowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log.EPSS 0.4%CVE-2026-90580MEDIUMFlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgeryEPSS 0.4%CVE-2024-36422MEDIUMGHSL-2023-245: Flowise xss in api/v1/chatflows/idEPSS 0.4%CVE-2024-36423MEDIUMGHSL-2023-246: Flowise xss in /api/v1/public-chatflows/idEPSS 0.4%