CVE records Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program , by email as they are published. Where the data comes from: sources .
Updated under an hour ago (2026-10-19 14:10 UTC )
This week: 5,511 CVEs published, 359 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.
Published in the last 7 days 5,511 Show in the list Critical, last 7 days 359 Show in the list Healthcare-tagged, last 7 days 5 Show in the list Known exploited (CISA KEV) 1,747 Show in the list Showing CVEs that name the product flowiseai:flowise . Show all products
130 CVEs, showing 101 to 130 Previous Page 3 of 3 CVE Severity Title Published CVE-2026-73484 High 8.6 Flowise before 3.1.3 Sandbox Escape via Pandas Methods Assigned by VulnCheck
Aug 13, 2026 CVE-2026-73485 Critical 9.0 Flowise before 3.1.3 Remote Code Execution via Airtable Agent Assigned by VulnCheck
Aug 13, 2026 CVE-2026-73486 Critical 9.0 Flowise before 3.1.3 Code Injection via CSV Agent customReadCSV Assigned by VulnCheck
Aug 13, 2026 CVE-2026-73487 Critical 9.0 Flowise before 3.1.3 Prompt Injection RCE via CSV Agent Assigned by VulnCheck
Aug 13, 2026 CVE-2026-73488 Medium 6.0 Flowise before 3.1.3 IDOR via customer-default-source endpoint Assigned by VulnCheck
Aug 13, 2026 CVE-2026-73601 Critical 9.0 Flowise before 3.1.3 Remote Code Execution via Custom MCP Assigned by VulnCheck
Aug 13, 2026 CVE-2026-73602 Critical 9.0 Flowise before 3.1.3 Sandbox Escape to RCE Assigned by VulnCheck
Aug 13, 2026 CVE-2026-73603 Medium 6.3 Flowise before 3.1.4 Credential Abuse via Text-to-Speech Assigned by VulnCheck
Aug 13, 2026 CVE-2026-73604 Medium 6.5 Flowise before 3.1.3 Credential Exposure via API Assigned by VulnCheck
Aug 13, 2026 CVE-2026-52098 Critical 9.8 An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpoint Assigned by mitre
Sep 10, 2026 CVE-2026-90533 Medium 6.0 Flowise before 3.1.4 Broken Access Control via organizationuser Assigned by VulnCheck
Sep 12, 2026 CVE-2026-90534 Medium 6.1 Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method Assigned by VulnCheck
Sep 12, 2026 CVE-2026-90535 Medium 6.3 Flowise before 3.1.4 Denial of Service via text-to-speech/abort Assigned by VulnCheck
Sep 12, 2026 CVE-2026-90580 Medium 6.3 FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery Assigned by VulDB
Sep 13, 2026 CVE-2026-91929 High 7.1 Flowise before 3.1.4 Cross-Tenant Authorization Bypass Assigned by VulnCheck
Sep 15, 2026 CVE-2026-91930 High 7.5 Flowise before 3.1.4 Cross-Tenant Organization Admin Takeover Assigned by VulnCheck
Sep 15, 2026 CVE-2026-91931 High 8.5 Flowise before 3.1.4 Remote Code Execution via Custom MCP npx Assigned by VulnCheck
Sep 15, 2026 CVE-2026-91932 High 8.5 Flowise before 3.1.4 Remote Code Execution via cwd Parameter Assigned by VulnCheck
Sep 15, 2026 CVE-2026-91933 High 7.1 Flowise before 3.1.4 Authorization Bypass via openai-realtime Assigned by VulnCheck
Sep 15, 2026 CVE-2026-91934 High 8.8 Flowise before 3.1.4 Remote Code Execution via SQL Database Chain Assigned by VulnCheck
Sep 15, 2026 CVE-2026-91935 High 8.3 Flowise before 3.1.4 SSRF and API Key Exfiltration via Chat Model Nodes Assigned by VulnCheck
Sep 15, 2026 CVE-2026-91936 Medium 6.8 Flowise before 3.1.4 Script Injection via Docker Workflows Assigned by VulnCheck
Sep 15, 2026 CVE-2026-91937 High 7.5 Flowise before 3.1.4 NoSQL Injection via sessionId Assigned by VulnCheck
Sep 15, 2026 CVE-2026-91938 High 7.1 Flowise before 3.1.4 Server-Side Request Forgery via document loaders Assigned by VulnCheck
Sep 15, 2026 CVE-2026-100605 High 7.1 Flowise through 3.1.4 Missing Authorization via Chat Message Routes Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100606 High 7.7 Flowise through 3.1.4 Authentication Bypass via SSO Email Match Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100607 High 7.7 Flowise through 3.1.4 Authentication Bypass via Email-Only SSO Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100608 High 8.3 Flowise through 3.1.4 Authorization Bypass via BullMQ Dashboard Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100609 Medium 6.8 Flowise through 3.1.4 Insecure Direct Object Reference via Credential Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100610 High 7.5 Flowise through 3.1.4 Missing Authorization via upsert-history Assigned by VulnCheck
Sep 26, 2026
CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosec-signals.mtcgroupllc.com. Every record links back to the agency that published it.
