Vulnerabilidades em FlowiseAI

113 resultados
Análise Vexday

Com 62 CVEs catalogadas e 38 surgidas apenas nos últimos 90 dias, o FlowiseAI apresenta um ritmo de descoberta de vulnerabilidades consideravelmente acelerado, o que exige atenção contínua de equipes de segurança. Nenhuma das falhas consta atualmente no catálogo KEV da CISA — taxa abaixo da média geral do catálogo —, porém isso não reduz o risco potencial: o CVE-2025-59528 registra um score EPSS de 0,9018, indicando altíssima probabilidade de exploração em ambiente real segundo os modelos preditivos. Das 62 vulnerabilidades, 12 são classificadas como críticas e 3 possuem prova de conceito pública, ampliando a superfície de ataque para agentes mal-intencionados. O tipo de falha mais frequente é CWE-915 (modificação indevida de atributos de objetos de massa), padrão que frequentemente viabiliza bypass de controles de acesso e manipulação de dados sensíveis em aplicações orientadas a fluxos de IA.

CVE-2026-69253CRITICALFlowise Sandbox Escape to RCEEPSS 0.6%CVE-2026-73483CRITICALFlowise before 3.1.3 Sandbox Escape via PuppeteerEPSS 0.6%CVE-2026-41138HIGHFlowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using Pandas.EPSS 0.6%CVE-2026-69255CRITICALFlowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell VerifiedEPSS 0.6%CVE-2026-41265CRITICALFlowise: Airtable_Agent Code Injection Remote Code Execution VulnerabilityEPSS 0.6%CVE-2024-9148CRITICALFlowise Stored Cross-Site ScriptingEPSS 0.6%CVE-2026-70478CRITICALFlowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected serviceEPSS 0.5%CVE-2026-41274CRITICALFlowise: Cypher Injection in GraphCypherQAChainEPSS 0.5%CVE-2026-12821MEDIUMFlowiseAI Flowise S3 Document Loader S3.ts path traversalEPSS 0.5%CVE-2026-70636HIGHFlowise 3.1.4 Authentication Bypass via OAuth2 Credential Refresh EndpointEPSS 0.5%CVE-2026-30820HIGHFlowise Authorization Bypass via Spoofed x-request-from HeaderEPSS 0.5%CVE-2026-69263HIGHFlowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)EPSS 0.5%CVE-2026-41269HIGHFlowise: File Upload Validation Bypass in createAttachmentEPSS 0.5%CVE-2024-37145MEDIUMGHSL-2023-247: Flowise xss in /api/v1/chatflows-streaming/idEPSS 0.5%CVE-2026-69258HIGHFlowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction APIEPSS 0.5%CVE-2026-30823HIGHFlowise: IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO ConfigurationEPSS 0.4%CVE-2026-73484HIGHFlowise before 3.1.3 Sandbox Escape via Pandas MethodsEPSS 0.4%CVE-2026-70474HIGHFlowise: Cross-Workspace OAuth2 Credential Metadata LeakEPSS 0.4%CVE-2026-41278HIGHFlowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDsEPSS 0.4%CVE-2025-29192HIGHFlowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log.EPSS 0.4%