Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

Flowise Security Vulnerabilities | CyStack CVE Database

Vulnerability	Exploitation status	Fix	Affected product	Published	Severity

`CVE-2026-56271`Flowise - Weak Default JWT Secrets in Authentication Middleware	Exploitation statusNot known exploited	FixYes	Affected productFlowise	Published07/12/2026	SeverityCritical
`CVE-2026-56273`Flowise - Path Traversal in Vector Store basePath Parameter	Exploitation statusPublic exploit	FixYes	Affected productFlowise	Published07/08/2026	SeverityMedium
`CVE-2026-56278`Flowise - Session Hijacking via Weak Default Express Session Secret	Exploitation statusNot known exploited	FixYes	Affected productFlowise	Published06/30/2026	SeverityCritical
`CVE-2026-56277`Flowise - Hardcoded CORS Wildcard in TTS Endpoint	Exploitation statusNot known exploited	FixYes	Affected productFlowise	Published06/30/2026	SeverityMedium
`CVE-2026-58057`Flowise - Custom MCP Environment Variable Denylist Bypass via Case Sensitivity	Exploitation statusPublic exploit	FixYes	Affected productFlowise	Published06/28/2026	SeverityLow
`CVE-2025-71338`Flowise - Arbitrary File Write to Remote Code Execution via document-store API	Exploitation statusPublic exploit	FixNot confirmed	Affected productFlowise	Published06/25/2026	SeverityCritical
`CVE-2025-71336`Flowise - Unsandboxed Remote Code Execution via Custom MCP	Exploitation statusPublic exploit	FixYes	Affected productFlowise	Published06/25/2026	SeverityCritical
`CVE-2025-71335`Flowise - Session Invalidation Failure After Password Change	Exploitation statusNot known exploited	FixYes	Affected productFlowise	Published06/25/2026	SeverityHigh
`CVE-2025-71334`Flowise - Arbitrary File Access via Missing Chat Flow ID Validation	Exploitation statusPublic exploit	FixYes	Affected productFlowise	Published06/25/2026	SeverityCritical
`CVE-2025-71333`Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint	Exploitation statusPublic exploit	FixYes	Affected productFlowise	Published06/25/2026	SeverityCritical
`CVE-2025-71328`Flowise - Unverified Password Change via Account Settings	Exploitation statusPublic exploit	FixYes	Affected productFlowise	Published06/25/2026	SeverityHigh
`CVE-2025-71327`Flowise - Authentication Bypass via Unprotected Registration Endpoint	Exploitation statusPublic exploit	FixNot confirmed	Affected productFlowise	Published06/25/2026	SeverityCritical
`CVE-2025-71324`Flowise - Arbitrary File Read via chatId Parameter	Exploitation statusPublic exploit	FixYes	Affected productFlowise	Published06/25/2026	SeverityHigh
`CVE-2026-56272`Flowise - Insufficient Password Salt Rounds in Bcrypt Hashing	Exploitation statusNot known exploited	FixYes	Affected productFlowise	Published06/24/2026	SeverityMedium
`CVE-2026-56270`Flowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint	Exploitation statusPublic exploit	FixYes	Affected productFlowise	Published06/24/2026	SeverityHigh
`CVE-2026-56269`Flowise - Weak Default Token Hash Secret in JWT Token Encryption	Exploitation statusNot known exploited	FixYes	Affected productFlowise	Published06/24/2026	SeverityMedium
`CVE-2025-71332`Flowise - SQL Injection in importChatflows API via chatflow.id Parameter	Exploitation statusPublic exploit	FixYes	Affected productFlowise	Published06/24/2026	SeverityHigh
`CVE-2026-56275`Flowise - Server-Side Request Forgery via Execute Flow Base URL	Exploitation statusNot known exploited	FixYes	Affected productFlowise	Published06/23/2026	SeverityMedium
`CVE-2026-56274`Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess	Exploitation statusPublic exploit	FixYes	Affected productFlowise	Published06/23/2026	SeverityHigh
`CVE-2025-71337`Flowise - Unverified Email Change via Account Profile Endpoint	Exploitation statusPublic exploit	FixYes	Affected productFlowise	Published06/23/2026	SeverityHigh
`CVE-2026-56268`Flowise - Cross-Workspace Information Disclosure via chatflows/apikey Endpoint	Exploitation statusPublic exploit	FixYes	Affected productFlowise	Published06/22/2026	SeverityMedium
`CVE-2026-56276`Flowise - Mass Assignment in PUT /api/v1/user Allows Password Hash Override	Exploitation statusPublic exploit	FixYes	Affected productFlowise	Published06/20/2026	SeverityMedium
`CVE-2026-56267`Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint	Exploitation statusPublic exploit	FixYes	Affected productFlowise	Published06/20/2026	SeverityMedium
`CVE-2025-71331`Flowise - Cross-Site Scripting in Chat Messages and Agent Workflows	Exploitation statusPublic exploit	FixYes	Affected productFlowise	Published06/20/2026	SeverityMedium
`CVE-2024-58351`Flowise - Remote Code Execution via overrideConfig Parameter	Exploitation statusNot known exploited	FixYes	Affected productFlowise	Published06/20/2026	SeverityCritical

25 / 25 Results

All vulnerabilities loaded

Security vulnerabilities from Flowise

Flowise

How many security vulnerabilities does Flowise have?

Which Flowise product has the most security vulnerabilities?

Filters

Run an in-depth assessment with complete web risk management

Popular Flowise products

Flowise

Flowise Components