Flowise Vulnerabilities

npm AI Agents

AI Threat Alert tracks 159 known vulnerabilities in Flowise, 36 rated critical — an AI/ML ai agents in the npm ecosystem. Each CVE includes CVSS severity, EPSS exploit probability, patch status, and CISO-grade analysis.

Data sources
159
Total CVEs
36
Critical
npm
Ecosystem
Aug 13, 2026
Last CVE
50%
Patch Rate
2d
Avg Time to Patch

Known Vulnerabilities (159 total, page 3 of 7)

Severity CVE ID Summary CVSS Published
CRITICAL CVE-2025-71338 Flowise: unauthenticated file write enables RCE 10.0 Jun 25, 2026 HIGH CVE-2025-71328 Flowise: unverified password change enables account takeover 8.3 Jun 25, 2026 HIGH CVE-2025-71324 Flowise: path traversal leaks database unauthenticated 7.5 Jun 25, 2026 CRITICAL CVE-2025-71327 Flowise: auth bypass grants full API access 9.1 Jun 25, 2026 HIGH CVE-2026-56270 Flowise: auth bypass exposes OAuth secrets in cleartext 7.5 Jun 24, 2026 MEDIUM CVE-2026-56269 Flowise: hardcoded JWT secret leaks user/workspace IDs 4.6 Jun 24, 2026 MEDIUM CVE-2026-56272 Flowise: weak bcrypt enables 30x faster password cracking 4.1 Jun 24, 2026 MEDIUM CVE-2025-71332 Flowise: SQL injection exposes AI credential store 6.5 Jun 24, 2026 HIGH CVE-2025-34267 Flowise: authenticated RCE via nodevm sandbox escape -- Oct 14, 2025 CRITICAL CVE-2026-56274 Flowise: RCE via MCP server command validation bypass 9.9 Jun 23, 2026 UNKNOWN CVE-2026-56275 Flowise: SSRF bypasses security check in Execute Flow -- Jun 23, 2026 HIGH CVE-2025-71337 Flowise: account takeover via unverified email change 8.3 Jun 23, 2026 HIGH CVE-2026-56268 Flowise: cross-workspace chatflow config disclosure 7.7 Jun 22, 2026 MEDIUM CVE-2026-12821 Flowise: path traversal in S3 loader exposes documents 6.3 Jun 21, 2026 MEDIUM CVE-2026-56276 Flowise: mass assignment enables credential hash override -- Jun 20, 2026 MEDIUM CVE-2026-56267 Flowise: PII exposure via unauthenticated password reset -- Jun 20, 2026 MEDIUM CVE-2025-71331 Flowise: XSS enables session hijacking in AI agent UI 6.1 Jun 20, 2026 CRITICAL CVE-2024-58351 Flowise: RCE and sandbox escape via overrideConfig 9.8 Jun 20, 2026 HIGH CVE-2026-46480 Flowise: mass-assignment allows cross-workspace takeover 8.8 Jun 8, 2026 HIGH CVE-2026-46479 Flowise: mass assignment cross-workspace takeover 8.8 Jun 8, 2026 HIGH CVE-2026-46478 Flowise: mass-assignment allows cross-workspace data takeover 8.8 Jun 8, 2026 HIGH CVE-2026-46477 Flowise: mass-assignment cross-workspace dataset takeover 8.8 Jun 8, 2026 HIGH CVE-2026-46476 Flowise: mass assignment enables cross-workspace takeover 8.8 Jun 8, 2026 HIGH CVE-2026-46475 Flowise: mass-assignment enables workspace takeover 8.8 Jun 8, 2026 HIGH CVE-2026-46444 Flowise: missing authz on vector store CRUD ops 8.8 Jun 8, 2026

Showing 51–75 of 159

Frequently asked questions

What is Flowise?

Flowise is an AI/ML ai agents tracked by AI Threat Alert for security vulnerabilities in the npm ecosystem.

How many known vulnerabilities does Flowise have?

Flowise has 159 known CVEs, 36 of them critical, tracked from NVD and GitHub Advisory.

Which ecosystem is Flowise distributed in?

Flowise is distributed via the npm ecosystem and categorized as ai agents.

Where does the Flowise vulnerability data come from?

Vulnerability data is sourced from NVD and GitHub Advisory, enriched with CVSS, EPSS, exploit signals, and patch status for each CVE.

How do I assess the risk of Flowise?

Review each CVE below — every entry shows CVSS severity, EPSS exploit probability, exploitation signals, and whether a patched version is available.

Monitor Flowise in your stack

Get instant alerts when new vulnerabilities affect Flowise. CISO analysis, ATLAS technique mappings, and compliance reports included.

Start Monitoring