35 matches found
EUVD-2026-78206
Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations...
CVE-2026-91197
Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations...
CVE-2026-91197 Flowable flowable-engine through 8.0.0 XXE via ProcessDiagramLayoutFactory
Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations...
CVE-2026-91197
Flowable flowable-engine through 8.0.0 contains an XML External Entity (XXE) injection in ProcessDiagramLayoutFactory.parseXml() , which fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations wi...
CVE-2026-91197 Flowable flowable-engine through 8.0.0 XXE via ProcessDiagramLayoutFactory
Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations...
CVE-2026-91197 Flowable flowable-engine through 8.0.0 XXE via ProcessDiagramLayoutFactory
Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations...
PT-2026-91755
Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations...
CVE-2026-91197: Improper Restriction of XML External Entity Reference
Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations...
Apache Syncope permission granting and access control issues
Apache Syncope is an open-source identity management and governance system that primarily provides features for user management, permission control, and role assignment. Apache Syncope has a security vulnerability that arises from the improper validation of authorization for users who register or...
Improper Isolation or Compartmentalization
Overview org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn is an Open Source system for managing digital identities in enterprise environments, Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization through...
CVE-2026-62183 Apache Syncope: User self-service privilege escalation
Improper Privilege Management vulnerability in Apache Syncope. When: the all-Java user workflow adapter is configured, or the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests the following...
CVE-2026-53405
The Apache Syncope identity management system (specifically the org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn package) is vulnerable to an Improper Isolation or Compartmentalization issue. An administrator with adequate entitlements can use the REST API to import and start arbitrary B...
CVE-2026-53405 Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask
Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy...
EUVD-2026-45956
Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy...
CVE-2026-53405 Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask
Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy...
CVE-2026-53405 Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask
Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy...
Flow code issues and vulnerabilities
Flow is a free and open-source enterprise-level process application developed by FlowwJ, a Chinese developer. It combines technologies such as Flowable to create an integrated process engine solution. There are code issues and vulnerabilities in Flow; these vulnerabilities stem from incorrect...
Flowable 2025.2 Brings Governed Multi-Agent AI Orchestration to Enterprises
Flowable has launched version 2025.2 of its enterprise work orchestration platform, adding support for governed multi-agent AI, impact…...
Gartner Recognizes Flowable in 2025 Magic Quadrant for Business Orchestration and Automation Technologies
ZÜRICH, Switzerland - Flowable, a global provider of enterprise automation and orchestration software, has been recognized in the…...