Open Source Flowise <3.1.0

productDE

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

7critical13high0medium0low

updated 2026-10-28

vulnerabilities (25)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-41264US	critical9.8	1.79% (78th)	Exploit	no fix	2026-04-23	—
CVE-2026-41268US	critical9.8	17.4% (97th)	—	no fix	2026-04-23	—
CVE-2026-41276US	critical9.8	6.87% (94th)	—	no fix	2026-04-23	—
CVE-2026-41266US	high7.5OT elevated	4.06% (91st)	—	no fix	2026-04-23	—
CVE-2026-41277US	high8.8	3.11% (88th)	—	no fix	2026-04-23	—
CVE-2026-56270US	high7.5OT elevated	2.05% (81st)	—	no fix	2026-06-24	—
CVE-2026-41137US	high8.8	1.45% (73rd)	—	no fix	2026-04-23	—
CVE-2026-56271US	—OT elevated	0.66% (51st)	—	no fix	2026-07-12	—
CVE-2026-41138US	high8.8	0.60% (49th)	—	no fix	2026-04-23	—
CVE-2026-41265US	critical9.8	0.57% (47th)	—	no fix	2026-04-23	—
CVE-2026-56278US	—OT elevated	0.53% (44th)	—	no fix	2026-06-30	—
CVE-2026-41274US	critical9.8	0.51% (43rd)	—	no fix	2026-04-23	—
CVE-2026-56273US	—	0.50% (43rd)	—	no fix	2026-07-08	—
CVE-2026-41269US	high8.8	0.47% (41st)	—	no fix	2026-04-23	—
CVE-2026-41278US	high7.5	0.42% (36th)	—	no fix	2026-04-23	—
CVE-2026-43995US	critical9.8	0.40% (34th)	—	no fix	2026-05-11	—
CVE-2026-41267US	critical9.8	0.33% (27th)	—	no fix	2026-04-23	—
CVE-2026-56275US	high7.1	0.32% (24th)	—	no fix	2026-06-23	—
CVE-2026-41273US	high8.2OT elevated	0.31% (23rd)	—	no fix	2026-04-23	—
CVE-2026-41279US	high7.5	0.26% (18th)	—	no fix	2026-04-23	—
CVE-2026-41272US	—	0.26% (17th)	—	no fix	2026-04-23	—
CVE-2026-41270US	high8.3	0.23% (14th)	—	no fix	2026-04-23	—
CVE-2026-41271US	high8.3	0.23% (14th)	—	no fix	2026-04-23	—
CVE-2026-41275US	high7.5OT elevated	0.18% (7th)	—	no fix	2026-04-23	—
CVE-2026-56269US	—OT elevated	0.13% (3rd)	—	no fix	2026-06-24	—

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-918Server-Side Request Forgery (SSRF)5 CVEs
CWE-639Authorization Bypass Through User-Controlled Key3 CVEs
CWE-184Incomplete List of Disallowed Inputs2 CVEs
CWE-20Improper Input Validation2 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor2 CVEs
CWE-284Improper Access Control2 CVEs
CWE-306Missing Authentication for Critical Function2 CVEs
CWE-798Use of Hard-coded Credentials2 CVEs

sources (1)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)25 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan