CVE-2025-58434-Flowiseai-Auth-Bypass-PoC

CVE-2025-58434 Flowiseai 認証バイパスPoC...

CVE-2025-59528-POC

CVE-2025-59528 - FlowiseAI CustomMCP 远程代码执行 CVSS 10.0（严重） | 盲式 RCE | FlowiseAI Flowise = 2.2.7-patch.1 且 3.0.6 概述 FlowiseAI Flowise 的 CustomMCP 节点中存在一个严重的远程代码执行漏洞。convertToValidJSONString 函数将来自 mcpServerConfig 参数的用户输入直接传递给 JavaScript 的 Function 构造函数，其功能等同于 eval，从而允许以完整的 Node.js 运行时权限执行任意 JavaScri...

FlowiseAI Flowise <= 2.2.6 - Arbitrary File Upload

FlowiseAI Flowise version 2.2.6 and below contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. This vulnerability allows an unauthenticated attacker to upload files outside the intended directory through path traversal, potentially leading to API key exposure and...

FlowiseAI-Critical-KillChain

FlowiseAI — 重大なキルチェーン FlowiseAI 5秒未満 での完全なコンテナ侵害、認証情報不要 。 キルチェーン...

CVE-2026-70473

creationtimestamp| type| source ---|---|--- 2026-08-04 18:35:03+00:00| published-proof-of-concept| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fr6g-7cq8-fg82 2026-08-06 20:45:07+00:00| seen| https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-per-flowise 2026-08-10...

CVE-2026-69251

creationtimestamp| type| source ---|---|--- 2026-08-04 16:35:26+00:00| published-proof-of-concept| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-g32j-mmxr-gfq5...

CVE-2026-69253

creationtimestamp| type| source ---|---|--- 2026-08-04 16:35:21+00:00| published-proof-of-concept| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wg86-r78f-74mp 2026-08-04 18:08:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbm6og5rg23...

CVE-2026-12821

A vulnerability was determined in FlowiseAI Flowise up to 3.1.2. The impacted element is an unknown function of the file packages/components/nodes/documentloaders/S3/S3.ts of the component S3 Document Loader. Executing a manipulation can lead to path traversal. It is possible to launch the attack...

CVE-2026-12821

A vulnerability was determined in FlowiseAI Flowise up to 3.1.2. The impacted element is an unknown function of the file packages/components/nodes/documentloaders/S3/S3.ts of the component S3 Document Loader. Executing a manipulation can lead to path traversal. It is possible to launch the attack...

CVE-2026-12821

Flowise Flowise (up to 3.1.2) is affected by a path traversal vulnerability in the S3 Document Loader, specifically in packages/components/nodes/documentloaders/S3/S3.ts. The description notes an unknown function as the vulnerable element and states that an attacker can exploit this remotely to t...

PT-2026-51263

A vulnerability was determined in FlowiseAI Flowise up to 3.1.2. The impacted element is an unknown function of the file packages/components/nodes/documentloaders/S3/S3.ts of the component S3 Document Loader. Executing a manipulation can lead to path traversal. It is possible to launch the attack...

EUVD-2026-35109

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the assistant update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId...

CVE-2026-8028

A vulnerability was detected in FlowiseAI Flowise up to 3.0.12. This affects the function verify of the file packages/server/src/enterprise/services/account.service.ts of the component Endpoint. Performing a manipulation results in information disclosure. Remote exploitation of the attack is...

CVE-2026-8027

A weakness has been identified in FlowiseAI Flowise up to 3.0.12. Affected by this vulnerability is an unknown functionality of the component User Controller Handler. This manipulation of the argument userId/organizationId/workspaceId/email causes authorization bypass. The attack may be initiated...

CVE-2026-8026

A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterprise/services/account.service.ts of the component API Response Handler. The manipulation results in information disclosure. The attack can be launched...

PT-2026-43619

Name of the Vulnerable Software and Affected Versions protobufjs affected versions not specified Description An issue exists where the software could recurse without a depth limit during the conversion of decoded messages to plain objects or JSON. This specifically affects the generated toObject...

NPM: FlowiseAI: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover

NPM: FlowiseAI: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.1...

NPM: FlowiseAI: Dataset create+update mass-assignment allows cross-workspace dataset takeover

NPM: FlowiseAI: Dataset create+update mass-assignment allows cross-workspace dataset takeover vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.1...

NPM: FlowiseAI: CustomTemplate create+update mass-assignment allows cross-workspace template takeover

NPM: FlowiseAI: CustomTemplate create+update mass-assignment allows cross-workspace template takeover vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.1...

NPM: FlowiseAI: Assistant create+update mass-assignment allows cross-workspace assistant takeover

NPM: FlowiseAI: Assistant create+update mass-assignment allows cross-workspace assistant takeover vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.1...