Lucene search
+L

13 matches found

EUVD
EUVD
•added 2026/09/26 1:22 p.m.•5 views

EUVD-2026-87705

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory returns UpsertHistory rows selected solely by an attacker-supplied...

7.7CVSS5.8AI score
SaveExploits0References2
NVD
NVD
•added 2026/08/04 7:16 p.m.•26 views

CVE-2026-70473

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB an...

8.5CVSS0.00451EPSS
SaveExploits1References4
Patchstack
Patchstack
•added 2026/08/04 5:57 p.m.•13 views

NPM: Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

NPM: Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

8.3CVSS5.5AI score0.00451EPSS
SaveExploits1References5Affected Software1
OSV
OSV
•added 2026/08/04 5:57 p.m.•10 views

GHSA-FR6G-7CQ8-FG82 Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

Summary The GET /api/v1/upsert-history endpoint returns the entire server-wide upsert history response size 100MB instead of being scoped to the requesting user/tenant/workspace. The response includes sensitive configuration data e.g., Vector Store settings such as Qdrant Server URL and collectio...

8.3CVSS5.5AI score0.00451EPSS
SaveExploits1References5
Github Security Blog
Github Security Blog
•added 2026/08/04 5:57 p.m.•20 views

Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

Summary The GET /api/v1/upsert-history endpoint returns the entire server-wide upsert history response size 100MB instead of being scoped to the requesting user/tenant/workspace. The response includes sensitive configuration data e.g., Vector Store settings such as Qdrant Server URL and collectio...

8.5CVSS5.5AI score0.00451EPSS
SaveExploits1References5Affected Software1
Snyk
Snyk
•added 2026/08/04 5:57 p.m.•14 views

Missing Authorization

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Missing Authorization in the GET /api/v1/upsert-history endpoint, which returns the entire server-wide upsert history, including sensitive configuration data such as integration parameters and infrastructur...

8.5CVSS5.3AI score0.00451EPSS
SaveExploits1References3
OSV
OSV
•added 2026/08/04 5:56 p.m.•15 views

CVE-2026-70473 Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB an...

8.3CVSS5.4AI score
SaveExploits0References6
EUVD
EUVD
•added 2026/08/04 5:56 p.m.•19 views

EUVD-2026-52853

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB an...

8.3CVSS5.5AI score0.00451EPSS
SaveExploits1References4
attackerkb
attackerkb
•added 2026/08/04 5:56 p.m.•12 views

CVE-2026-70473

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB an...

8.3CVSS5.5AI score0.00451EPSS
SaveExploits1References5Affected Software1
CVE
CVE
•added 2026/08/04 5:56 p.m.•85 views

CVE-2026-70473

Flowise (a UI for building LLM workflows) prior to version 3.1.3 exposed a server-wide upsert-history via GET /api/v1/upsert-history. The endpoint returned data scoped to none of the requester’s identity (user/tenant/workspace) and could exceed 100 MB, including sensitive configuration data such ...

8.5CVSS5.5AI score0.00451EPSS
SaveExploits1References4Affected Software1
Cvelist
Cvelist
•added 2026/08/04 5:56 p.m.•53 views

CVE-2026-70473 Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB an...

8.3CVSS0.00451EPSS
SaveExploits1References4
Vulnrichment
Vulnrichment
•added 2026/08/04 5:56 p.m.•9 views

CVE-2026-70473 Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB an...

8.3CVSS5.5AI score0.00451EPSS
SaveExploits1References4
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/08/04 12:00 a.m.•4 views

CVE-2026-70473: Exposure of Sensitive Information to an Unauthorized Actor

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB an...

8.5CVSS5.8AI score0.00451EPSS
SaveExploits1References8
Rows per page
Query Builder