Flowise Vulnerabilities

npmAI Agents

AI Threat Alert tracks 180 known vulnerabilities in Flowise, 37 rated critical — an AI/ML ai agents in the npm ecosystem. Each CVE includes CVSS severity, EPSS exploit probability, patch status, and CISO-grade analysis.

180
Total CVEs
37
Critical
npm
Ecosystem
Oct 30, 2026
Last CVE
46%
Patch Rate
4d
Avg Time to Patch

Known Vulnerabilities(180 total, page 4 of 8)

SeverityCVE IDSummaryCVSSPublished
HIGHCVE-2026-56270Flowise: auth bypass exposes OAuth secrets in cleartext7.5Jun 24, 2026MEDIUMCVE-2026-56269Flowise: hardcoded JWT secret leaks user/workspace IDs4.6Jun 24, 2026MEDIUMCVE-2026-56272Flowise: weak bcrypt enables 30x faster password cracking4.1Jun 24, 2026MEDIUMCVE-2025-71332Flowise: SQL injection exposes AI credential store6.5Jun 24, 2026HIGHCVE-2025-34267Flowise: authenticated RCE via nodevm sandbox escape--Oct 14, 2025CRITICALCVE-2026-56274Flowise: RCE via MCP server command validation bypass9.9Jun 23, 2026UNKNOWNCVE-2026-56275Flowise: SSRF bypasses security check in Execute Flow--Jun 23, 2026HIGHCVE-2025-71337Flowise: account takeover via unverified email change8.3Jun 23, 2026HIGHCVE-2026-56268Flowise: cross-workspace chatflow config disclosure7.7Jun 22, 2026MEDIUMCVE-2026-12821Flowise: path traversal in S3 loader exposes documents6.3Jun 21, 2026MEDIUMCVE-2026-56276Flowise: mass assignment enables credential hash override--Jun 20, 2026MEDIUMCVE-2026-56267Flowise: PII exposure via unauthenticated password reset--Jun 20, 2026MEDIUMCVE-2025-71331Flowise: XSS enables session hijacking in AI agent UI6.1Jun 20, 2026CRITICALCVE-2024-58351Flowise: RCE and sandbox escape via overrideConfig9.8Jun 20, 2026HIGHCVE-2026-46480Flowise: mass-assignment allows cross-workspace takeover8.8Jun 8, 2026HIGHCVE-2026-46479Flowise: mass assignment cross-workspace takeover8.8Jun 8, 2026HIGHCVE-2026-46478Flowise: mass-assignment allows cross-workspace data takeover8.8Jun 8, 2026HIGHCVE-2026-46477Flowise: mass-assignment cross-workspace dataset takeover8.8Jun 8, 2026HIGHCVE-2026-46476Flowise: mass assignment enables cross-workspace takeover8.8Jun 8, 2026HIGHCVE-2026-46475Flowise: mass-assignment enables workspace takeover8.8Jun 8, 2026HIGHCVE-2026-46444Flowise: missing authz on vector store CRUD ops8.8Jun 8, 2026MEDIUMCVE-2026-46443Flowise: stored credentials exposed via API filter bug6.5Jun 8, 2026CRITICALCVE-2026-46442Flowise: sandbox escape enables authenticated RCE9.9Jun 8, 2026CRITICALCVE-2026-46441Flowise: mass assignment breaks multi-tenant isolation9.6Jun 8, 2026CRITICALCVE-2026-46440Flowise: plaintext auth brute-force, no rate limit9.1Jun 8, 2026

Showing 76–100 of 180

Frequently asked questions

What is Flowise?

Flowise is an AI/ML ai agents tracked by AI Threat Alert for security vulnerabilities in the npm ecosystem.

How many known vulnerabilities does Flowise have?

Flowise has 180 known CVEs, 37 of them critical, tracked from NVD and GitHub Advisory.

Which ecosystem is Flowise distributed in?

Flowise is distributed via the npm ecosystem and categorized as ai agents.

Where does the Flowise vulnerability data come from?

Vulnerability data is sourced from NVD and GitHub Advisory, enriched with CVSS, EPSS, exploit signals, and patch status for each CVE.

How do I assess the risk of Flowise?

Review each CVE below — every entry shows CVSS severity, EPSS exploit probability, exploitation signals, and whether a patched version is available.

Monitor Flowise in your stack

Get instant alerts when new vulnerabilities affect Flowise. CISO analysis, ATLAS technique mappings, and compliance reports included.

Start Monitoring