Vulnerabilities
Last updated 2 hours ago
| Package | Summary | Severity | Published | Modified |
|---|---|---|---|---|
flowise
|
FlowiseDB vulnerable to SQL Injection by authenticated users | Medium Risk 5.9 | 1 year ago | 15 hours ago |
|
flowise
|
Flowise allows arbitrary file write to RCE | Critical 10.0 | 1 year ago | 17 hours ago |
|
flowise
|
Flowise has unsandboxed remote code execution via Custom MCP | Critical 9.8 | 1 year ago | 17 hours ago |
|
flowise
|
Flowise has arbitrary file access due to missing chat flow id validation | Critical 9.8 | 1 year ago | 17 hours ago |
|
flowise
|
Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium | Critical 9.5 | 27 days ago | 4 days ago |
|
flowise-components
|
Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium | Critical 9.5 | 27 days ago | 4 days ago |
|
flowise
|
Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass | Critical 9.5 | 27 days ago | 27 days ago |
|
flowise-components
|
Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass | Critical 9.5 | 27 days ago | 27 days ago |
|
flowise
|
Flowise Execute Flow function has an SSRF vulnerability | High Risk 7.1 | 6 months ago | 1 month ago |
|
flowise-components
|
Flowise Execute Flow function has an SSRF vulnerability | High Risk 7.1 | 6 months ago | 1 month ago |
|
flowise
|
Flowise OverrideConfig security vulnerability | High Risk 8.0 | 1 year ago | 1 month ago |
|
flowise
|
Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses | High Risk 8.0 | 3 months ago | 2 months ago |
|
flowise
|
Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint | Medium Risk 6.0 | 3 months ago | 2 months ago |
|
flowise
|
Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials | Medium Risk 6.0 | 3 months ago | 2 months ago |
|
flowise
|
Flowise: Incomplete Credential Redaction Exposes Secrets via API | Medium Risk 6.5 | 3 months ago | 2 months ago |
|
flowise
|
Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability | Critical 9.5 | 3 months ago | 3 months ago |
|
flowise-components
|
Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability | Critical 9.5 | 3 months ago | 3 months ago |
|
flowise
|
Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service | Critical 9.5 | 3 months ago | 3 months ago |
|
flowise
|
Flowise: Missing Authorization on Execution Update Endpoint | High Risk 8.0 | 3 months ago | 3 months ago |
|
flowise
|
Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation | High Risk 8.0 | 3 months ago | 3 months ago |
|
flowise
|
Flowise: Cross-Workspace OAuth2 Credential Metadata Leak | High Risk 8.0 | 3 months ago | 3 months ago |
|
flowise
|
Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure | High Risk 8.0 | 3 months ago | 3 months ago |
|
flowise
|
Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store | High Risk 8.0 | 3 months ago | 3 months ago |
|
flowise
|
Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history | High Risk 8.0 | 3 months ago | 3 months ago |
|
flowise
|
Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation | Critical 9.5 | 3 months ago | 3 months ago |
|
flowise-components
|
Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation | Critical 9.5 | 3 months ago | 3 months ago |
|
flowise
|
Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys | High Risk 8.0 | 3 months ago | 3 months ago |
|
flowise-components
|
Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys | High Risk 8.0 | 3 months ago | 3 months ago |
|
flowise
|
Flowise: Remote Code Execution Vulnerability in CSVAgent | Critical 9.5 | 3 months ago | 3 months ago |
|
flowise-components
|
Flowise: Remote Code Execution Vulnerability in CSVAgent | Critical 9.5 | 3 months ago | 3 months ago |
|
flowise
|
Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE | Critical 9.5 | 3 months ago | 3 months ago |
|
flowise-components
|
Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE | Critical 9.5 | 3 months ago | 3 months ago |
|
flowise
|
Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE) | High Risk 8.0 | 3 months ago | 3 months ago |
|
flowise-components
|
Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE) | High Risk 8.0 | 3 months ago | 3 months ago |
|
flowise
|
Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type | High Risk 8.0 | 3 months ago | 3 months ago |
|
flowise
|
Flowise RCE via SQLite Record Manager Node | Critical 9.5 | 3 months ago | 3 months ago |
|
flowise-components
|
Flowise RCE via SQLite Record Manager Node | Critical 9.5 | 3 months ago | 3 months ago |
|
flowise
|
Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API | High Risk 8.0 | 3 months ago | 3 months ago |
|
flowise
|
Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override | Critical 9.5 | 3 months ago | 3 months ago |
|
flowise-components
|
Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override | Critical 9.5 | 3 months ago | 3 months ago |
|
flowise
|
Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified | Critical 9.5 | 3 months ago | 3 months ago |
|
flowise-components
|
Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified | Critical 9.5 | 3 months ago | 3 months ago |
|
flowise
|
Flowise Sandbox Escape to RCE | Critical 9.5 | 3 months ago | 3 months ago |
|
flowise-components
|
Flowise Sandbox Escape to RCE | Critical 9.5 | 3 months ago | 3 months ago |
|
flowise
|
Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization | High Risk 8.0 | 3 months ago | 3 months ago |
|
flowise
|
Flowise RCE via TypeORM DataSource | Critical 9.5 | 3 months ago | 3 months ago |
|
flowise-components
|
Flowise RCE via TypeORM DataSource | Critical 9.5 | 3 months ago | 3 months ago |
|
flowise
|
Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration | High Risk 8.0 | 3 months ago | 3 months ago |
|
flowise
|
Flowise has an Arbitrary File Read | Critical 9.1 | 1 year ago | 3 months ago |
|
flowise
|
Flowise: Weak Default Token Hash Secret | Medium Risk 5.6 | 6 months ago | 3 months ago |
Page 1