CVE Browser

Flowise through 3.1.4 Missing Authorization via upsert-history

Flowise through 3.1.4 Insecure Direct Object Reference via Credential

Flowise through 3.1.4 Authorization Bypass via BullMQ Dashboard

Flowise through 3.1.4 Authentication Bypass via Email-Only SSO

Flowise through 3.1.4 Authentication Bypass via SSO Email Match

Flowise through 3.1.4 Missing Authorization via Chat Message Routes

Flowise before 3.1.4 Server-Side Request Forgery via document loaders

Flowise before 3.1.4 NoSQL Injection via sessionId

Flowise before 3.1.4 Script Injection via Docker Workflows

Flowise before 3.1.4 SSRF and API Key Exfiltration via Chat Model Nodes

Flowise before 3.1.4 Remote Code Execution via SQL Database Chain

Flowise before 3.1.4 Authorization Bypass via openai-realtime

Flowise before 3.1.4 Remote Code Execution via cwd Parameter

Flowise before 3.1.4 Remote Code Execution via Custom MCP npx

Flowise before 3.1.4 Cross-Tenant Organization Admin Takeover

Flowise before 3.1.4 Cross-Tenant Authorization Bypass

FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery

Flowise before 3.1.4 Denial of Service via text-to-speech/abort

Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method

Flowise before 3.1.4 Broken Access Control via organizationuser

An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpoint

Flowise before 3.1.3 Credential Exposure via API

Flowise before 3.1.4 Credential Abuse via Text-to-Speech

Flowise before 3.1.3 Sandbox Escape to RCE

Flowise before 3.1.3 Remote Code Execution via Custom MCP