CVE-2026-100610 - flowise
In Flowise versions up to 3.1.4, the web endpoints that show or remove upsert‑history do not verify who is allowed to use them. Because of this, any logged‑in user or holder of a…

Too many irrelevant or confusing CVEs? Use stackflag.com

#flowise #flowiseai #CVE #infosec

CVE-2026-100605 - flowise
In Flowise versions up to 3.1.4, API keys that are meant to have limited rights can still call the chat message functions and view or erase past conversations. This could let…

Too many irrelevant or confusing CVEs? Use stackflag.com

#flowise #flowiseai #CVE #infosec

CVE-2026-100607 - flowise
Flowise versions up to 3.1.4 identify users only by their email address and do not keep track of which single sign‑on service or password was used. Because of this, someone who…

Too many irrelevant or confusing CVEs? Use stackflag.com

#flowise #flowiseai #CVE #infosec

CVE-2026-100606 - flowise
When Flowise is set up with single sign‑on, an email address used for an invitation can be used to log in without the invitation token. Anyone who can sign in to the same SSO…

Too many irrelevant or confusing CVEs? Use stackflag.com

#flowise #flowiseai #CVE #infosec

Chinese hackers exploit #WordPress, #Zyxel flaws to steal govt data

https://www.bleepingcomputer.com/news/security/chinese-hackers-exploit-multiple-technologies-to-steal-govt-data/

#cybersecurity #China #PANOS #FlowiseAI #Nuclio #Proxmox #Ubiquity

CVE-2026-91934 - flowise
Versions of Flowise earlier than 3.1.4 do not check file locations when using the SQLite database feature. A user who has a valid account can place arbitrary files on the server,…

Too many irrelevant or confusing CVEs? Use stackflag.com

#flowise #flowiseai #CVE #infosec

CVE-2026-91930 - flowise
In versions of Flowise earlier than 3.1.4, the system does not correctly limit certain management functions to the user's own company. A logged‑in user can trick the software into…

Too many irrelevant or confusing CVEs? Use stackflag.com

#flowise #flowiseai #CVE #infosec

CVE-2026-91932 - flowise
The Flowise application (versions earlier than 3.1.4) can be tricked by a signed‑in user into accepting a crafted directory path, which then lets the attacker run their own…

Too many irrelevant or confusing CVEs? Use stackflag.com

#flowise #flowiseai #CVE #infosec

CVE-2026-91931 - flowise
If you run Flowise version earlier than 3.1.4, a feature called the Custom MCP node can be tricked by a signed‑in user to download and run any npm package. This lets the attacker…

Too many irrelevant or confusing CVEs? Use stackflag.com

#flowise #flowiseai #CVE #infosec