Product by FlowiseAI
Flowise-components
19 known vulnerabilities in Flowise-components (FlowiseAI), 0 of them actively exploited (CISA KEV).
Key figures
19
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
13
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-41268 | Flowise: Flowise Parameter Override Bypass Remote Command Execution | 9.8 | |
| Critical | CVE-2026-56274 | Flowise: OS Command Injection | 9.9 | |
| Critical | CVE-2026-40933 | Flowise: Authenticated RCE Via MCP Adapters | 9.9 | |
| Critical | CVE-2026-69251 | Flowise RCE via TypeORM DataSource | 8.8 | |
| Critical | CVE-2026-41264 | Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability | 9.8 | |
| High | CVE-2026-31829 | Flowise: Server-Side Request Forgery (SSRF) | 7.1 | |
| Critical | CVE-2026-41137 | Flowise: Code Injection in CSVAgent leads to Authenticated RCE | 8.8 | |
| Critical | CVE-2026-73487 | Flowise before 3.1.3 Prompt Injection RCE via CSV Agent | 9.8 | |
| Critical | CVE-2026-70477 | Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability | 9.8 | |
| Critical | CVE-2026-73483 | Flowise before 3.1.3 Sandbox Escape via Puppeteer | 8.8 | |
| Critical | CVE-2026-41265 | Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability | 9.8 | |
| Critical | CVE-2026-41274 | Flowise: Cypher Injection in GraphCypherQAChain | 9.8 | |
| Critical | CVE-2026-119978 | Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore | 8.5 | |
| High | CVE-2026-41138 | Flowise: Code Injection | 8.8 | |
| Critical | CVE-2026-43995 | Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure) | 9.8 | |
| High | CVE-2026-41270 | Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox | 8.3 | |
| High | CVE-2026-41271 | Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains | 8.3 | |
| High | CVE-2026-56275 | Flowise - Server-Side Request Forgery via Execute Flow Base URL | 7.1 | |
| High | CVE-2026-41272 | Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure) | 7.1 |