Known Vulnerabilities for Flowise by FlowiseAI
Listed below are 10 of the newest known vulnerabilities associated with "Flowise" by "FlowiseAI".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-100610 json | Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission ... | Not Provided | 2026-09-26 | 2026-09-28 |
| CVE-2026-100609 json | Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the r... | Not Provided | 2026-09-26 | 2026-09-30 |
| CVE-2026-100608 json | Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode with t... | Not Provided | 2026-09-26 | 2026-09-26 |
| CVE-2026-100607 json | Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bi... | Not Provided | 2026-09-26 | 2026-09-28 |
| CVE-2026-100606 json | Flowise through 3.1.4 (Enterprise/platform mode with SSO enabled) contains an authentication bypass in the SSO login path. Wh... | Not Provided | 2026-09-26 | 2026-09-28 |
| CVE-2026-100605 json | Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API keys t... | Not Provided | 2026-09-26 | 2026-09-30 |
| CVE-2026-91938 json | Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer docum... | Not Provided | 2026-09-15 | 2026-09-17 |
| CVE-2026-91937 json | Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queries within the M... | Not Provided | 2026-09-15 | 2026-09-15 |
| CVE-2026-91936 json | Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflow_dispatc... | Not Provided | 2026-09-15 | 2026-09-17 |
| CVE-2026-91935 json | Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect reque... | Not Provided | 2026-09-15 | 2026-09-20 |