# Flowiseai Flowise


- [CVE-2025-71338](https://insights.sbomify.com/CVE-2025-71338/): Flowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store API (critical 10.0)
- [CVE-2026-40933](https://insights.sbomify.com/CVE-2026-40933/): Flowise: Authenticated RCE Via MCP Adapters (critical 10.0)
- [CVE-2025-61913](https://insights.sbomify.com/CVE-2025-61913/): Flowise is vulnerable to arbitrary file read, arbitrary file write (critical 10.0)
- [CVE-2025-59528](https://insights.sbomify.com/CVE-2025-59528/): Flowise has Remote Code Execution vulnerability (critical 10.0)
- [CVE-2026-52098](https://insights.sbomify.com/CVE-2026-52098/): Code injection in n/a (critical 9.8)
- [CVE-2025-58434](https://insights.sbomify.com/CVE-2025-58434/): Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover (critical 9.8)
- [CVE-2025-8943](https://insights.sbomify.com/CVE-2025-8943/): Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers (critical 9.8)
- [CVE-2025-26319](https://insights.sbomify.com/CVE-2025-26319/): FlowiseAI Flowise arbitrary file upload vulnerability (critical 9.8)
- [CVE-2024-8181](https://insights.sbomify.com/CVE-2024-8181/): Flowise Authentication Bypass (critical 9.8)
- [CVE-2024-9148](https://insights.sbomify.com/CVE-2024-9148/): Flowise Stored Cross-Site Scripting (critical 9.6)
- [CVE-2026-70470](https://insights.sbomify.com/CVE-2026-70470/): Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE (critical 9.5)
- [CVE-2026-70477](https://insights.sbomify.com/CVE-2026-70477/): Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability (critical 9.5)

---
From sbomify Insights: https://insights.sbomify.com/products/flowiseai/flowise/