Skip to content
Noroxi

FlowiseAI records

128 published records for vendor flowiseai.

Researcher profile

Entered KEV
0 · 0%
Weaponized
5 · 3.9%
Pre-auth RCE
15
With a fix record
82.8%
Median publish → KEV
No record has entered KEV

Records by year

  1. 24
  2. 25
  3. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

128 records
  • CVE-2025-59528
    66This week

    Flowise has Remote Code Execution vulnerability

    CriticalCVSS 10.0WeaponizedEPSS 86%

    flowiseai · flowiseSep 22, 2025

  • CVE-2025-58434
    64This week

    Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover

    CriticalCVSS 9.8WeaponizedEPSS 82%

    flowiseai · flowiseSep 12, 2025

  • CVE-2025-8943
    62This week

    Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers

    CriticalCVSS 9.8WeaponizedEPSS 75%

    flowiseai · flowiseAug 14, 2025

  • CVE-2026-41264
    60This week

    Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

    CriticalCVSS 9.2WeaponizedEPSS 1%

    flowiseai · flowiseApr 23, 2026

  • CVE-2025-26319
    56Plan

    FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.

    CriticalCVSS 9.8Proof of conceptEPSS 55%

    flowiseai · flowiseMar 4, 2025

  • CVE-2024-31621
    48Plan

    An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 c

    HighCVSS 7.6Proof of conceptEPSS 59%

    flowiseai · flowiseApr 29, 2024

  • CVE-2026-46442
    47Plan

    Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape

    CriticalCVSS 9.4Proof of conceptEPSS 32%

    flowiseai · flowiseJun 8, 2026

  • CVE-2024-8181
    46Plan

    Flowise Authentication Bypass

    HighCVSS 8.1Proof of conceptEPSS 45%

    flowiseai · flowiseAug 27, 2024

  • CVE-2026-41268
    44Plan

    Flowise: Flowise Parameter Override Bypass Remote Command Execution

    CriticalCVSS 9.8No exploitEPSS 17%

    flowiseai · flowiseApr 23, 2026

  • CVE-2025-61913
    43Plan

    Flowise is vulnerable to arbitrary file read, arbitrary file write

    CriticalCVSS 9.9No exploitEPSS 13%

    flowiseai · flowiseOct 8, 2025

  • CVE-2026-40933
    43Plan

    Flowise: Authenticated RCE Via MCP Adapters

    CriticalCVSS 9.9No exploitEPSS 11%

    flowiseai · flowiseApr 21, 2026

  • CVE-2026-30824
    41Plan

    Flowise: Missing Authentication on NVIDIA NIM Endpoints

    HighCVSS 7.7Proof of conceptEPSS 37%

    flowiseai · flowiseMar 7, 2026

  • CVE-2026-56274
    40Plan

    Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess

    HighCVSS 8.7WeaponizedEPSS 7%

    flowiseai · flowiseJun 23, 2026

  • CVE-2025-71338
    40Plan

    Flowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store API

    CriticalCVSS 10.0Proof of conceptEPSS 1%

    flowiseai · flowiseJun 25, 2026

  • CVE-2025-61687
    39Monitor

    FlowiseAI/Flosise has File Upload vulnerability

    HighCVSS 8.8No exploitEPSS 11%

    flowiseai · flowiseOct 6, 2025

  • CVE-2026-52098
    39Monitor

    An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpoint

    CriticalCVSS 9.8No exploitEPSS 1%

    flowiseai · flowiseSep 10, 2026

  • CVE-2026-41267
    39Monitor

    Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association

    CriticalCVSS 9.8No exploitEPSS 0%

    flowiseai · flowiseApr 23, 2026

  • CVE-2025-71334
    38Monitor

    Flowise - Arbitrary File Access via Missing Chat Flow ID Validation

    CriticalCVSS 9.3Proof of conceptEPSS 4%

    flowiseai · flowiseJun 25, 2026

  • CVE-2026-70470
    38Monitor

    Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

    CriticalCVSS 9.5No exploitEPSS 0%

    flowiseai · flowiseAug 4, 2026

  • CVE-2026-70477
    38Monitor

    Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

    CriticalCVSS 9.5No exploitEPSS 0%

    flowiseai · flowiseAug 4, 2026

  • CVE-2026-30821
    37Monitor

    Flowise: Arbitrary File Upload via MIME Spoofing

    HighCVSS 8.2No exploitEPSS 16%

    flowiseai · flowiseMar 7, 2026

  • CVE-2026-69251
    37Monitor

    Flowise RCE via TypeORM DataSource

    CriticalCVSS 9.0Proof of conceptEPSS 2%

    flowiseai · flowiseAug 4, 2026

  • CVE-2026-41137
    37Monitor

    Flowise: Code Injection in CSVAgent leads to Authenticated RCE

    CriticalCVSS 9.4No exploitEPSS 1%

    flowiseai · flowiseApr 23, 2026

  • CVE-2025-71336
    37Monitor

    Flowise - Unsandboxed Remote Code Execution via Custom MCP

    CriticalCVSS 9.3No exploitEPSS 1%

    flowiseai · flowiseJun 25, 2026

  • CVE-2026-69264
    37Monitor

    Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

    CriticalCVSS 9.4No exploitEPSS 1%

    flowiseai · flowiseAug 4, 2026