Vulnerabilidades em FlowiseAI

84 resultados
Análise Vexday

Com 62 CVEs catalogadas e 38 surgidas apenas nos últimos 90 dias, o FlowiseAI apresenta um ritmo de descoberta de vulnerabilidades consideravelmente acelerado, o que exige atenção contínua de equipes de segurança. Nenhuma das falhas consta atualmente no catálogo KEV da CISA — taxa abaixo da média geral do catálogo —, porém isso não reduz o risco potencial: o CVE-2025-59528 registra um score EPSS de 0,9018, indicando altíssima probabilidade de exploração em ambiente real segundo os modelos preditivos. Das 62 vulnerabilidades, 12 são classificadas como críticas e 3 possuem prova de conceito pública, ampliando a superfície de ataque para agentes mal-intencionados. O tipo de falha mais frequente é CWE-915 (modificação indevida de atributos de objetos de massa), padrão que frequentemente viabiliza bypass de controles de acesso e manipulação de dados sensíveis em aplicações orientadas a fluxos de IA.

CVE-2025-59528CRITICALFlowise has Remote Code Execution vulnerabilityEPSS 90.2%CVE-2025-58434CRITICALFlowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account TakeoverEPSS 50.2%CVE-2024-8181CRITICALFlowise Authentication BypassEPSS 45.1%CVE-2026-30824HIGHFlowise: Missing Authentication on NVIDIA NIM EndpointsEPSS 36.3%CVE-2026-30821HIGHFlowise: Arbitrary File Upload via MIME SpoofingEPSS 14.7%CVE-2024-8182HIGHFlowise Denial of ServiceEPSS 13.9%CVE-2026-41268HIGHFlowise: Flowise Parameter Override Bypass Remote Command ExecutionEPSS 13.8%CVE-2026-40933CRITICALFlowise: Authenticated RCE Via MCP AdaptersEPSS 13.4%CVE-2025-50538HIGHFlowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log.EPSS 13.1%CVE-2026-30822HIGHFlowise: Mass Assignment in `/api/v1/leads` EndpointEPSS 12.9%CVE-2025-61913CRITICALFlowise is vulnerable to arbitrary file read, arbitrary file writeEPSS 12.1%CVE-2025-61687HIGHFlowiseAI/Flosise has File Upload vulnerabilityEPSS 10.3%CVE-2026-41276HIGHFlowise: AccountService resetPassword Authentication Bypass VulnerabilityEPSS 6.9%CVE-2025-34267HIGHFlowise Authenticated Command Execution and Sandbox Bypass via Puppeteer & Playwright PackagesEPSS 6.1%CVE-2024-36421HIGHGHSL-2023-234: Flowise Cors Misconfiguration in packages/server/src/index.tsEPSS 6.0%CVE-2025-59527HIGHFlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerabilityEPSS 4.7%CVE-2026-41266HIGHFlowise: Sensitive Data Leak in public-chatbotConfigEPSS 4.1%CVE-2026-46442CRITICALFlowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox EscapeEPSS 3.5%CVE-2025-59434CRITICALCritical Multi-Tenant Variable Disclosure in Flowise Cloud via Custom JavaScript FunctionEPSS 3.1%CVE-2026-41277HIGHFlowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR)EPSS 3.1%