Flowise Vulnerabilities

npmAI Agents

AI Threat Alert tracks 180 known vulnerabilities in Flowise, 37 rated critical — an AI/ML ai agents in the npm ecosystem. Each CVE includes CVSS severity, EPSS exploit probability, patch status, and CISO-grade analysis.

180
Total CVEs
37
Critical
npm
Ecosystem
Oct 30, 2026
Last CVE
46%
Patch Rate
4d
Avg Time to Patch

Known Vulnerabilities(180 total, page 5 of 8)

SeverityCVE IDSummaryCVSSPublished
MEDIUMGHSA-m837-xvxr-vqwgFlowise: hardcoded CORS wildcard enables drive-by credential abuse--May 20, 2026MEDIUMGHSA-59fh-9f3p-7m39Flowise: mass assignment bypasses password controls--May 20, 2026MEDIUMGHSA-c2c9-mfw7-p8hwFlowise: cross-workspace chatflow config disclosure--May 20, 2026HIGHGHSA-hmg2-jjjx-jcp2Flowise: missing authz on vector store CRUD endpoints--May 14, 2026HIGHGHSA-78pr-c5x5-jggcFlowise: IDOR via mass assignment breaks tenant isolation--May 14, 2026HIGHGHSA-728h-4mwj-f2p4Flowise: mass assignment breaks cross-workspace isolation--May 14, 2026HIGHGHSA-5h9v-837x-m97rFlowise: mass assignment enables cross-workspace data takeover--May 14, 2026HIGHGHSA-7j65-65cr-6644Flowise: mass assignment breaks cross-workspace isolation--May 14, 2026HIGHGHSA-mq53-pc65-wjc4Flowise: mass assignment breaks workspace isolation--May 14, 2026HIGHGHSA-wxrr-jp8m-qq7fFlowise: mass assignment enables cross-workspace IDOR--May 14, 2026HIGHCVE-2026-42861Flowise: mass assignment breaks multi-tenant isolation--May 14, 2026HIGHCVE-2026-42862Flowise: mass assignment breaks tenant isolation--May 14, 2026HIGHCVE-2026-42863Flowise: Mass Assignment enables cross-workspace takeover--May 14, 2026HIGHGHSA-php6-83fg-gw3gFlowise: brute-force auth grants full agent platform access7.5May 14, 2026HIGHGHSA-m99r-2hxc-cp3qFlowise MCP: 3-path blocklist bypass enables server RCE--May 14, 2026HIGHGHSA-hp26-q66v-q2w7Flowise: mass assignment breaks multi-tenant isolation--May 14, 2026CRITICALGHSA-9rvc-vf7m-pgm2Flowise: auth RCE via NodeVM sandbox escape--May 14, 2026HIGHGHSA-7g73-99r4-m4mjFlowise: credential data leak via filtered API endpoint--May 14, 2026LOWCVE-2026-8026Flowise: info disclosure via login API response handler3.7May 6, 2026CRITICALCVE-2026-43995Flowise: SSRF in agent tools bypasses security wrapper9.8May 11, 2026CRITICALCVE-2026-41274Flowise: Cypher injection via GraphCypherQAChain node9.8Apr 23, 2026HIGHCVE-2026-41279Flowise: unauth API key abuse via TTS endpoint IDOR7.5Apr 23, 2026HIGHCVE-2026-41278Flowise: credential exposure in public chatflow API7.5Apr 23, 2026HIGHCVE-2026-41277Flowise: mass assignment enables cross-workspace IDOR8.8Apr 23, 2026CRITICALCVE-2026-41276Flowise: auth bypass enables full account takeover via reset9.8Apr 23, 2026

Showing 101–125 of 180

Frequently asked questions

What is Flowise?

Flowise is an AI/ML ai agents tracked by AI Threat Alert for security vulnerabilities in the npm ecosystem.

How many known vulnerabilities does Flowise have?

Flowise has 180 known CVEs, 37 of them critical, tracked from NVD and GitHub Advisory.

Which ecosystem is Flowise distributed in?

Flowise is distributed via the npm ecosystem and categorized as ai agents.

Where does the Flowise vulnerability data come from?

Vulnerability data is sourced from NVD and GitHub Advisory, enriched with CVSS, EPSS, exploit signals, and patch status for each CVE.

How do I assess the risk of Flowise?

Review each CVE below — every entry shows CVSS severity, EPSS exploit probability, exploitation signals, and whether a patched version is available.

Monitor Flowise in your stack

Get instant alerts when new vulnerabilities affect Flowise. CISO analysis, ATLAS technique mappings, and compliance reports included.

Start Monitoring