Vulnerabilidades em FlowiseAI

113 resultados
Análise Vexday

Com 62 CVEs catalogadas e 38 surgidas apenas nos últimos 90 dias, o FlowiseAI apresenta um ritmo de descoberta de vulnerabilidades consideravelmente acelerado, o que exige atenção contínua de equipes de segurança. Nenhuma das falhas consta atualmente no catálogo KEV da CISA — taxa abaixo da média geral do catálogo —, porém isso não reduz o risco potencial: o CVE-2025-59528 registra um score EPSS de 0,9018, indicando altíssima probabilidade de exploração em ambiente real segundo os modelos preditivos. Das 62 vulnerabilidades, 12 são classificadas como críticas e 3 possuem prova de conceito pública, ampliando a superfície de ataque para agentes mal-intencionados. O tipo de falha mais frequente é CWE-915 (modificação indevida de atributos de objetos de massa), padrão que frequentemente viabiliza bypass de controles de acesso e manipulação de dados sensíveis em aplicações orientadas a fluxos de IA.

CVE-2026-41267HIGHFlowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization AssociationEPSS 0.3%CVE-2026-91929HIGHFlowise before 3.1.4 Cross-Tenant Authorization BypassEPSS 0.3%CVE-2026-46444HIGHFlowise: Vector Store No Permission ChecksEPSS 0.3%CVE-2026-91933HIGHFlowise before 3.1.4 Authorization Bypass via openai-realtimeEPSS 0.3%CVE-2026-67622HIGHFlowise 3.1.4 IDOR in OpenAI Assistants IntegrationEPSS 0.3%CVE-2026-73488MEDIUMFlowise before 3.1.3 IDOR via customer-default-source endpointEPSS 0.3%CVE-2026-67620MEDIUMFlowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-ListEPSS 0.3%CVE-2026-70476HIGHFlowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing ManipulationEPSS 0.3%CVE-2026-69262HIGHFlowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow typeEPSS 0.3%CVE-2026-41273HIGHFlowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public ChatflowEPSS 0.3%CVE-2026-70475HIGHFlowise: Missing Authorization on Execution Update EndpointEPSS 0.3%CVE-2026-70473HIGHFlowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert historyEPSS 0.3%CVE-2026-8027MEDIUMFlowiseAI Flowise User Controller authorizationEPSS 0.3%CVE-2026-69257HIGHFlowise: SSRF Protection Bypass via IPv4-Mapped IPv6 AddressesEPSS 0.3%CVE-2026-91937HIGHFlowise before 3.1.4 NoSQL Injection via sessionIdEPSS 0.3%CVE-2026-91935HIGHFlowise before 3.1.4 SSRF and API Key Exfiltration via Chat Model NodesEPSS 0.3%CVE-2026-46441HIGHFlowise: Mass Assignment in Assistant Update Endpoint Allows Cross-Workspace Resource ReassignmentEPSS 0.3%CVE-2026-90535MEDIUMFlowise before 3.1.4 Denial of Service via text-to-speech/abortEPSS 0.3%CVE-2026-46443HIGHFlowise: Credential Data LeakEPSS 0.3%CVE-2026-42863HIGHFlowise: Mass Assignment in Chatflow Update Endpoint Allows Cross-Workspace AgentFlow ReassignmentEPSS 0.3%