Flowise
- Software type
- AI and machine learning platform
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/08/2026, Flowise recorded 31 security vulnerabilities in the last 90 days, of which 25 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Flowise and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-30821Flowise: Arbitrary File Upload via MIME SpoofingCVE-2026-30820Flowise Authorization Bypass via Spoofed x-request-from HeaderCVE-2025-34267Flowise Authenticated Command Execution and Sandbox Bypass via Puppeteer & Playwright PackagesCVE-2025-61913Flowise is vulnerable to arbitrary file read, arbitrary file writeCVE-2025-61687FlowiseAI/Flosise has File Upload vulnerability| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-30821Flowise: Arbitrary File Upload via MIME Spoofing | Exploitation statusActively exploited | FixYes |
| SeverityHigh |
CVE-2026-30820Flowise Authorization Bypass via Spoofed x-request-from Header | Exploitation statusActively exploited | FixYes | Published03/07/2026 | SeverityHigh |
|---|
CVE-2025-34267Flowise Authenticated Command Execution and Sandbox Bypass via Puppeteer & Playwright Packages | Exploitation statusActively exploited | FixYes | Published10/14/2025 | SeverityHigh |
|---|
CVE-2025-61913Flowise is vulnerable to arbitrary file read, arbitrary file write | Exploitation statusActively exploited | FixNo | Published10/08/2025 | SeverityCritical |
|---|
CVE-2025-61687FlowiseAI/Flosise has File Upload vulnerability | Exploitation statusActively exploited | FixNo | Published10/06/2025 | SeverityHigh |
|---|
CVE-2025-50538CVE-2025-50538 | Exploitation statusActively exploited | FixYes | Published10/06/2025 | SeverityHigh |
|---|
CVE-2025-29192CVE-2025-29192 | Exploitation statusActively exploited | FixYes | Published10/06/2025 | SeverityHigh |
|---|
CVE-2025-59528Flowise has Remote Code Execution vulnerability | Exploitation statusActively exploited | FixYes | Published09/22/2025 | SeverityCritical |
|---|
CVE-2025-59527FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability | Exploitation statusActively exploited | FixYes | Published09/22/2025 | SeverityHigh |
|---|
CVE-2025-59434Critical Multi-Tenant Variable Disclosure in Flowise Cloud via Custom JavaScript Function | Exploitation statusActively exploited | FixYes | Published09/22/2025 | SeverityCritical |
|---|
CVE-2025-58434Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover | Exploitation statusActively exploited | FixNo | Published09/12/2025 | SeverityCritical |
|---|
CVE-2024-8182Flowise Denial of Service | Exploitation statusNot exploited | FixNo | Published08/27/2024 | SeverityHigh |
|---|
CVE-2024-8181Flowise Authentication Bypass | Exploitation statusNot exploited | FixNo | Published08/27/2024 | SeverityCritical |
|---|
CVE-2024-37146GHSL-2023-248: Flowise xss in /api/v1/credentials/id | Exploitation statusNot exploited | FixNo | Published07/01/2024 | SeverityMedium |
|---|
CVE-2024-37145GHSL-2023-247: Flowise xss in /api/v1/chatflows-streaming/id | Exploitation statusNot exploited | FixNo | Published07/01/2024 | SeverityMedium |
|---|
CVE-2024-36423GHSL-2023-246: Flowise xss in /api/v1/public-chatflows/id | Exploitation statusNot exploited | FixNo | Published07/01/2024 | SeverityMedium |
|---|
CVE-2024-36422GHSL-2023-245: Flowise xss in api/v1/chatflows/id | Exploitation statusNot exploited | FixNo | Published07/01/2024 | SeverityMedium |
|---|
CVE-2024-36421GHSL-2023-234: Flowise Cors Misconfiguration in packages/server/src/index.ts | Exploitation statusNot exploited | FixNo | Published07/01/2024 | SeverityHigh |
|---|
CVE-2024-36420GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-file | Exploitation statusNot exploited | FixNo | Published07/01/2024 | SeverityHigh |
|---|
119 Results | Page 3 of 3