All packages
Flowise vulnerabilities
103 known CVE vulnerabilities in Flowise, translated and rated.
- CVE-2026-42862Medium
A mass assignment vulnerability in the tool update endpoint of Flowise allows authenticated users to modify server-controlled properties such as workspaceId, breaking tenant isolation in multi-workspace environments.
- CVE-2025-29192High
Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log.
- CVE-2025-29189High
Flowise <= 2.2.3 is vulnerable to SQL Injection via tableName parameter at Postgres_VectorStores.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS