Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Flowise — Vulnerabilities & Security Advisories 144

All 144 CVE vulnerabilities found in Flowise, with AI-generated Chinese analysis, references, and POCs.

This page documents known security vulnerabilities associated with the open-source orchestration framework Flowise, categorized under common weakness types such as improper input validation and authorization failures. The collection aggregates public disclosure records, vendor advisories, and community-reported issues ranging from the project's initial release through recent updates, providing a comprehensive historical view of its security posture. Here, you can track a vendor's advisories to understand the timeline and remediation efforts behind specific patches, understand a weakness class by observing how certain architectural patterns in LLM orchestration tools manifest as exploitable bugs, or look up a product's vulnerability history to assess its stability and risk profile over time. This resource serves as a neutral reference for security researchers, developers, and enterprise buyers evaluating Flowise for deployment in production environments. By centralizing disparate sources of vulnerability data, the page eliminates the need to search multiple CVE databases or project repositories individually. Users can analyze trends in bug reports, compare the frequency of critical severity issues against less severe findings, and review the effectiveness of past security responses. The data is structured to facilitate quick retrieval of relevant information without requiring deep knowledge of the underlying codebase, enabling stakeholders to make informed decisions regarding risk mitigation and upgrade strategies.

Vendor: FlowiseAI

CVE ID Title CVSS Severity Published
CVE-2026-40933 Flowise: Authenticated RCE Via MCP Adapters CWE-78 10.0 Critical 2026-04-21
CVE-2026-31829 Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access CWE-918 7.1 High 2026-03-10
CVE-2026-30824 Flowise: Missing Authentication on NVIDIA NIM Endpoints CWE-306 10.0 - 2026-03-07
CVE-2026-30823 Flowise: IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration CWE-639 8.1 - 2026-03-07
CVE-2026-30822 Flowise: Mass Assignment in `/api/v1/leads` Endpoint CWE-915 5.3 - 2026-03-07
CVE-2026-30821 Flowise: Arbitrary File Upload via MIME Spoofing CWE-434 9.8 - 2026-03-07
CVE-2026-30820 Flowise Authorization Bypass via Spoofed x-request-from Header CWE-863 8.8 - 2026-03-07
CVE-2025-34267 Flowise Authenticated Command Execution and Sandbox Bypass via Puppeteer & Playwright Packages CWE-77 8.4 High 2025-10-14
CVE-2025-61913 Flowise is vulnerable to arbitrary file read, arbitrary file write CWE-22 10.0 Critical 2025-10-08
CVE-2025-61687 FlowiseAI/Flosise has File Upload vulnerability CWE-434 8.3 High 2025-10-06
CVE-2025-29192 Flowise 安全漏洞 CWE-79 8.2 High 2025-10-06
CVE-2025-50538 Flowise 安全漏洞 CWE-79 8.2 High 2025-10-06
CVE-2025-59528 Flowise has Remote Code Execution vulnerability CWE-94 10.0 Critical 2025-09-22
CVE-2025-59527 FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability CWE-918 7.5 High 2025-09-22
CVE-2025-59434 Critical Multi-Tenant Variable Disclosure in Flowise Cloud via Custom JavaScript Function CWE-200 9.6 Critical 2025-09-22
CVE-2025-58434 Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover CWE-306 9.8 Critical 2025-09-12
CVE-2024-8181 Flowise Authentication Bypass 9.8 Critical 2024-08-27
CVE-2024-8182 Flowise Denial of Service 7.5 High 2024-08-27
CVE-2024-37146 GHSL-2023-248: Flowise xss in /api/v1/credentials/id CWE-79 6.1 Medium 2024-07-01
CVE-2024-37145 GHSL-2023-247: Flowise xss in /api/v1/chatflows-streaming/id CWE-79 6.1 Medium 2024-07-01
CVE-2024-36423 GHSL-2023-246: Flowise xss in /api/v1/public-chatflows/id CWE-79 6.1 Medium 2024-07-01
CVE-2024-36422 GHSL-2023-245: Flowise xss in api/v1/chatflows/id CWE-79 6.1 Medium 2024-07-01
CVE-2024-36421 GHSL-2023-234: Flowise Cors Misconfiguration in packages/server/src/index.ts CWE-346 7.5 High 2024-07-01
CVE-2024-36420 GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-file CWE-74 7.5 High 2024-07-01

All 144 known CVE vulnerabilities affecting Flowise with full Chinese analysis, references, and POCs where available.