Flowise Vulnerabilities

npmAI Agents

AI Threat Alert tracks 180 known vulnerabilities in Flowise, 37 rated critical — an AI/ML ai agents in the npm ecosystem. Each CVE includes CVSS severity, EPSS exploit probability, patch status, and CISO-grade analysis.

180
Total CVEs
37
Critical
npm
Ecosystem
Oct 30, 2026
Last CVE
46%
Patch Rate
4d
Avg Time to Patch

Known Vulnerabilities(180 total, page 3 of 8)

SeverityCVE IDSummaryCVSSPublished
HIGHCVE-2026-69262Flowise: broken authz allows cross-type flow deletion--Aug 4, 2026UNKNOWNCVE-2026-69259Flowise: RCE via SQLite path overwrite + root Docker--Aug 4, 2026MEDIUMGHSA-2364-jh4q-m9vmFlowise: IDOR exposes customer PII and billing data--Aug 4, 2026UNKNOWNCVE-2026-69250Flowise: unauthenticated SSRF leaks OAuth secrets--Aug 4, 2026UNKNOWNCVE-2026-69251Flowise: TypeORM config injection enables RCE--Aug 4, 2026UNKNOWNCVE-2026-69252Flowise: missing authz allows cross-workspace file wipe--Aug 4, 2026CRITICALCVE-2026-69253Flowise: code injection in agent tools escapes vm2 sandbox--Aug 4, 2026UNKNOWNCVE-2026-69254Flowise: authenticated RCE as root via NodeVM sandbox escape--Aug 4, 2026UNKNOWNCVE-2026-69255Flowise: code injection in CSVAgent enables root RCE--Aug 4, 2026CRITICALCVE-2026-69256Flowise: RCE via pickle deserialization in CSVAgent--Aug 4, 2026UNKNOWNCVE-2026-69257Flowise: SSRF via IPv4-mapped IPv6 deny-list bypass--Aug 4, 2026HIGHCVE-2026-69258Flowise: unauth overrideConfig injects flow session state--Aug 4, 2026CRITICALCVE-2026-56271Flowise: hardcoded JWT secrets enable full auth bypass9.8Jul 12, 2026MEDIUMCVE-2026-56273Flowise: path traversal in vector store basePath6.5Jul 8, 2026UNKNOWNCVE-2026-56277Flowise: wildcard CORS on TTS endpoint abuses creds--Jun 30, 2026CRITICALCVE-2026-56278Flowise: hardcoded default secret enables session forgery9.1Jun 30, 2026MEDIUMCVE-2026-58057Flowise: NODE_OPTIONS denylist bypass allows RCE5.0Jun 28, 2026CRITICALCVE-2025-71333Flowise: unauth file upload + path traversal enables RCE--Jun 25, 2026CRITICALCVE-2025-71336Flowise: unauthenticated RCE via Custom MCP endpoint9.8Jun 25, 2026HIGHCVE-2025-71335Flowise: password change fails to revoke sessions8.1Jun 25, 2026CRITICALCVE-2025-71334Flowise: path traversal → RCE via missing UUID validation9.8Jun 25, 2026CRITICALCVE-2025-71338Flowise: unauthenticated file write enables RCE10.0Jun 25, 2026HIGHCVE-2025-71328Flowise: unverified password change enables account takeover8.3Jun 25, 2026HIGHCVE-2025-71324Flowise: path traversal leaks database unauthenticated7.5Jun 25, 2026CRITICALCVE-2025-71327Flowise: auth bypass grants full API access9.1Jun 25, 2026

Showing 51–75 of 180

Frequently asked questions

What is Flowise?

Flowise is an AI/ML ai agents tracked by AI Threat Alert for security vulnerabilities in the npm ecosystem.

How many known vulnerabilities does Flowise have?

Flowise has 180 known CVEs, 37 of them critical, tracked from NVD and GitHub Advisory.

Which ecosystem is Flowise distributed in?

Flowise is distributed via the npm ecosystem and categorized as ai agents.

Where does the Flowise vulnerability data come from?

Vulnerability data is sourced from NVD and GitHub Advisory, enriched with CVSS, EPSS, exploit signals, and patch status for each CVE.

How do I assess the risk of Flowise?

Review each CVE below — every entry shows CVSS severity, EPSS exploit probability, exploitation signals, and whether a patched version is available.

Monitor Flowise in your stack

Get instant alerts when new vulnerabilities affect Flowise. CISO analysis, ATLAS technique mappings, and compliance reports included.

Start Monitoring