CVE-2026-40914

creationtimestamp| type| source ---|---|--- 2026-05-27 17:32:33+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mmtzzmt3ah2e 2026-05-29 11:39:38+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3mmyhafj65s2p...

GHSA-HP26-Q66V-Q2W7 FlowiseAI has Mass Assignment in Assistant Update Endpoint that Allows Cross-Workspace Resource Reassignment

Summary A Mass Assignment vulnerability exists in the assistant update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating an assistant resource. Due to missing server-side validation...

FlowiseAI has Mass Assignment in Assistant Update Endpoint that Allows Cross-Workspace Resource Reassignment

Summary A Mass Assignment vulnerability exists in the assistant update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating an assistant resource. Due to missing server-side validation...

FlowiseAI has Mass Assignment in Chatflow Update Endpoint that Allows Cross-Workspace AgentFlow Reassignment

Summary A Mass Assignment vulnerability exists in the chatflow update endpoint of FlowiseAI. The endpoint allows clients to modify server-controlled properties such as deployed, isPublic, workspaceId, createdDate, and updatedDate when updating a chatflow object. Due to missing server-side...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the /api/v1/variables endpoint. A user can modify internal attributes such as workspaceId, createdDate, and updatedDate by...

GHSA-6FW7-3Q8R-M5VJ FlowiseAI has Mass Assignment in Variable Update Endpoint that Allows Cross-Workspace Resource Reassignment

Summary A Mass Assignment vulnerability exists in the variable update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating a variable resource. Due to missing server-side validation an...

PT-2026-40975

Summary A Mass Assignment vulnerability exists in the variable update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating a variable resource. Due to missing server-side validation an...

PT-2026-41206

Summary A Mass Assignment vulnerability exists in the assistant update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating an assistant resource. Due to missing server-side validation...

PT-2026-40976

Summary A Mass Assignment vulnerability exists in the tool update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating a tool resource. Due to missing server-side validation and...

GHSA-MQ4R-H2GH-QV7X Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint

Summary A Mass Assignment vulnerability in the /api/v1/leads endpoint allows any unauthenticated user to control internal entity fields id, createdDate, chatId by including them in the request body. The endpoint uses Object.assign to copy all properties from the request body to the Lead entity...

PT-2026-23788

Flowise and Affected Versions Flowise versions prior to 3.0.13 Description Flowise is a drag & drop user interface to build a customized large language model flow. A mass assignment issue exists in the /api/v1/leads endpoint, allowing unauthenticated users to control internal entity fields id,...

GHSA-CMXJ-WX9V-52QR

creationtimestamp| type| source ---|---|--- 2025-07-16 09:39:31+00:00| seen| https://gist.github.com/safer-bot/e9d5252cf350a9514cc3b81edb9d24d8...

GHSA-QCWQ-55HX-V3VH

creationtimestamp| type| source ---|---|--- 2025-07-16 03:46:52+00:00| seen| https://gist.github.com/safer-bot/8f576481ae0b25c2f9292db6db5e2aa7...

CVE-2025-27791

creationtimestamp| type| source ---|---|--- 2025-04-15 20:08:02+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114343784101287084 2025-04-15 22:28:06+00:00| seen| https://t.me/cvedetector/23001...

CVE-2024-54311

creationtimestamp| type| source ---|---|--- 2024-12-14 02:00:00+00:00| seen| https://infosec.exchange/users/cve/statuses/113648703899137316...

CVE-2024-10898

creationtimestamp| type| source ---|---|--- 2024-11-21 03:07:49+00:00| seen| https://infosec.exchange/users/cve/statuses/113518737411581057 2026-04-08 23:00:15+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mizfihcwag2v...

CVE-2021-36875

Cross-site Scripting XSS vulnerability in Stylemix Directory Listings WordPress plugin – uListing allows Reflected XSS.This issue affects Directory Listings WordPress plugin – uListing: from n/a through 2.0.5...

CVE-2021-37656

creationtimestamp| type| source ---|---|--- 2021-08-13 00:40:20+00:00| published-proof-of-concept| https://t.me/cibsecurity/27278...

CVE-2018-4222

creationtimestamp| type| source ---|---|--- 2018-06-08 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/44859...

CVE-2016-3134

creationtimestamp| type| source ---|---|--- 2016-03-09 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/39545...