Lucene search
+L

1077 matches found

Nuclei
Nuclei
added 13 hours ago29 views

Flowise - NVIDIA NIM Endpoints Missing Authentication

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router /api/v1/nvidia-nim/ is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generati...

9.8CVSS5.5AI score0.3625EPSS
SaveExploits2References3
Nuclei
Nuclei
added 13 hours ago28 views

Flowise 1.4.3 - Arbitrary File Read

Flowise 1.4.3 contains a path traversal caused by lack of sanitization of 'fileName' parameter in /api/v1/openai-assistants-file endpoint in index.ts, letting attackers read arbitrary files, exploit requires attacker to send crafted request. id: CVE-2024-36420 info: name: Flowise 1.4.3 - Arbitrar...

7.5CVSS7.3AI score0.01776EPSS
SaveExploits3References3
Nuclei
Nuclei
added 13 hours ago7 views

Flowise - Path Traversal

Flowise = 2.2.8 contains a path traversal vulnerability caused by missing validation of chatflowId and chatId parameters in file handling, letting unauthenticated attackers read and write arbitrary files, exploit requires no authentication. id: CVE-2025-71334 info: name: Flowise - Path Traversal...

9.8CVSS5.6AI score0.03903EPSS
SaveExploits1References2
Nuclei
Nuclei
added 13 hours ago8 views

Flowise < 3.1.2 - node-custom-function Unauthorized RCE

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When...

9.9CVSS6.6AI score0.03489EPSS
SaveExploits2References3
Nuclei
Nuclei
added 13 hours ago159 views

Flowise 1.6.5 - Authentication Bypass

The flowise version = 1.6.5 is vulnerable to authentication bypass vulnerability. id: CVE-2024-31621 info: name: Flowise 1.6.5 - Authentication Bypass author: DhiyaneshDK severity: high description: | The flowise version = 1.6.5 is vulnerable to authentication bypass vulnerability. impact: |...

7.6CVSS7.2AI score0.59867EPSS
SaveExploits4References3
Circl
Circl
added yesterday4 views

CVE-2026-70476

creationtimestamp| type| source ---|---|--- 2026-08-04 20:35:21+00:00| published-proof-of-concept| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-gmmw-qg98-6j6p...

8.3CVSS5.3AI score
SaveExploits0References1
NVD
NVD
added yesterday4 views

CVE-2026-70476

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accept...

8.3CVSS
SaveExploits0References4
NVD
NVD
added yesterday6 views

CVE-2026-70477

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, a prompt injection sent to a chatflow using a CSV Agent node can cause the LLM to respond with a malicious Python script that bypasses the blocklist validator and executes in an unsandboxed...

9.5CVSS
SaveExploits0References4
Circl
Circl
added yesterday4 views

CVE-2026-70477

creationtimestamp| type| source ---|---|--- 2026-08-04 20:12:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbt4g2hcj2z 2026-08-04 20:35:19+00:00| published-proof-of-concept| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-5xvg-pmgg-3mxr 2026-08-05...

9.5CVSS5.3AI score
SaveExploits0References4
Patchstack
Patchstack
added yesterday6 views

NPM: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

NPM: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

9.5CVSS5.7AI score
SaveExploits0References5Affected Software1
Patchstack
Patchstack
added yesterday5 views

NPM: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

NPM: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

9.5CVSS5.7AI score
SaveExploits0References5Affected Software1
Cvelist
Cvelist
added yesterday25 views

CVE-2026-70477 Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, a prompt injection sent to a chatflow using a CSV Agent node can cause the LLM to respond with a malicious Python script that bypasses the blocklist validator and executes in an unsandboxed...

9.5CVSS
SaveExploits0References4
CVE
CVE
added yesterday14 views

CVE-2026-70477

Flowise CSV Agent prompt injection leads to remote code execution. In Flowise prior to 3.1.3, the CSV_Agents.run method uses untrusted data to build an LLM prompt, and the resulting pythonCode is executed after a validation step, which can bypass safeguards and run arbitrary code in the service a...

9.5CVSS6.1AI score
SaveExploits0References4
Cvelist
Cvelist
added yesterday23 views

CVE-2026-70476 Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accept...

8.3CVSS
SaveExploits0References4
CVE
CVE
added yesterday19 views

CVE-2026-70476

Flowise (drag‑and‑drop UI for building LLM flows) has a Broken Access Control in Stripe subscription endpoints. Prior to version 3.1.3, endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accepted attac...

8.3CVSS5.5AI score
SaveExploits0References4
CVE
CVE
added yesterday13 views

CVE-2026-70475

Flowise user interface (Flowise) is affected by a vulnerability in the PUT /api/v1/executions/:id endpoint prior to version 3.1.3. The endpoint lacked the checkAnyPermission() middleware that protects other execution endpoints, allowing any authenticated user to modify execution state, data, and ...

7.1CVSS5.6AI score
SaveExploits0References4
NVD
NVD
added yesterday7 views

CVE-2026-70474

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise has three OAuth2 credential endpoints that look up credentials by id alone with no workspaceId filter. The authorize, callback, and refresh handlers query the Credential table...

7.6CVSS
SaveExploits0References2
Circl
Circl
added yesterday4 views

CVE-2026-69264

creationtimestamp| type| source ---|---|--- 2026-08-04 18:35:05+00:00| published-proof-of-concept| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-4j8x-x6v7-w9rq 2026-08-04 19:14:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbpuojef22m...

9.4CVSS5.3AI score
SaveExploits0References2
Circl
Circl
added yesterday4 views

CVE-2026-69259

creationtimestamp| type| source ---|---|--- 2026-08-04 18:14:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbmjgbfph2b 2026-08-04 18:35:12+00:00| published-proof-of-concept| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x3hf-7cj6-3r4m...

9.4CVSS5.3AI score
SaveExploits0References2
Patchstack
Patchstack
added yesterday6 views

NPM: Flowise: Cross-Workspace OAuth2 Credential Metadata Leak

NPM: Flowise: Cross-Workspace OAuth2 Credential Metadata Leak vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

7.6CVSS5.4AI score
SaveExploits0References3Affected Software1
Rows per page
Query Builder