Latest high and critical flaws
- CVE-2026-56271 Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and issCritical 9.3 · Jul 12, 2026
- CVE-2026-56278 Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the express-session middleware when the EXPRESSCritical 9.3 · Jun 30, 2026
- CVE-2025-71338 Flowise through 2.2.7 fails to sanitize path segments in the document-store loader endpoint, allowing unauthenticated attackers to write files outside the storaCritical 10 · Jun 25, 2026
- CVE-2025-71336 Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, which Critical 9.3 · Jun 25, 2026
- CVE-2025-71335 Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password.High 8.6 · Jun 25, 2026
- CVE-2025-71334 Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chaCritical 9.3 · Jun 25, 2026
- CVE-2025-71333 Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local.Critical 9.3 · Jun 25, 2026
- CVE-2025-71328 Flowise before 3.0.10 contains an unverified password change vulnerability.High 8.7 · Jun 25, 2026
- CVE-2025-71327 Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create useCritical 9.3 · Jun 25, 2026
- CVE-2025-71324 Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/dowHigh 8.7 · Jun 25, 2026
- CVE-2026-56270 Flowise before 3.1.0 (versions 3.0.13 and earlier) contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint that allows unauthenticatHigh 8.7 · Jun 24, 2026
- CVE-2025-71332 Flowise through 2.2.7 contains a SQL injection vulnerability in the importChatflows API.High 8.5 · Jun 24, 2026
- CVE-2026-56274 Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server feature due to incomplete command-flag validation and a regHigh 8.7 · Jun 23, 2026
- CVE-2025-71337 Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability.High 8.7 · Jun 23, 2026
- CVE-2024-58351 Flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the overrideConfig option, supported in both the frontend web iCritical 9.3 · Jun 20, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.