Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 402,183All CVEsplus 19,142 rejected
- 228Last 24 hours3,241 in the last 7 days
- 16,852Last 30 days1,538 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 27 | 63 | 12 | 0 | 0 | 102 | 120 |
| 2025 | 4 | 5 | 0 | 0 | 0 | 9 | 18 |
| 2024 | 2 | 3 | 4 | 0 | 0 | 9 | 9 |
| Title | ||
|---|---|---|
| CVE-2026-119978 | Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStoreFlowiseAI · Flowise | Critical9.0 |
| CVE-2026-100610 | Flowise through 3.1.4 Missing Authorization via upsert-historyPublic exploitFlowiseAI · Flowise | High7.7 |
| CVE-2026-100609 | Flowise through 3.1.4 Insecure Direct Object Reference via CredentialPublic exploitFlowiseAI · Flowise | High7.6 |
| CVE-2026-100608 | Flowise through 3.1.4 Authorization Bypass via BullMQ DashboardPublic exploitFlowiseAI · Flowise | High8.7 |
| CVE-2026-100607 | Flowise through 3.1.4 Authentication Bypass via Email-Only SSOPublic exploitFlowiseAI · Flowise | Critical9.2 |
| CVE-2026-100606 | Flowise through 3.1.4 Authentication Bypass via SSO Email MatchPublic exploitFlowiseAI · Flowise | Critical9.2 |
| CVE-2026-100605 | Flowise through 3.1.4 Missing Authorization via Chat Message RoutesPublic exploitFlowiseAI · Flowise | High7.5 |
| CVE-2026-91938 | Flowise before 3.1.4 Server-Side Request Forgery via document loadersFlowiseAI · Flowise | High7.6 |
| CVE-2026-91937 | Flowise before 3.1.4 NoSQL Injection via sessionIdFlowiseAI · Flowise | High8.7 |
| CVE-2026-91936 | Flowise before 3.1.4 Script Injection via Docker WorkflowsPublic exploitFlowiseAI · Flowise | High8.3 |
| CVE-2026-91935 | Flowise before 3.1.4 SSRF and API Key Exfiltration via Chat Model NodesPublic exploitFlowiseAI · Flowise | High8.7 |
| CVE-2026-91934 | Flowise before 3.1.4 Remote Code Execution via SQL Database ChainFlowiseAI · Flowise | High8.7 |
| CVE-2026-91933 | Flowise before 3.1.4 Authorization Bypass via openai-realtimeFlowiseAI · Flowise | High7.6 |
| CVE-2026-91932 | Flowise before 3.1.4 Remote Code Execution via cwd ParameterPublic exploitFlowiseAI · Flowise | Critical9.0 |
| CVE-2026-91931 | Flowise before 3.1.4 Remote Code Execution via Custom MCP npxPublic exploitFlowiseAI · Flowise | Critical9.0 |
| CVE-2026-91930 | Flowise before 3.1.4 Cross-Tenant Organization Admin TakeoverPublic exploitFlowiseAI · Flowise | High7.7 |
| CVE-2026-91929 | Flowise before 3.1.4 Cross-Tenant Authorization BypassFlowiseAI · Flowise | High7.6 |
| CVE-2026-90580 | FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgeryPublic exploitFlowiseAI · Flowise | Medium5.3 |
| CVE-2026-90535 | Flowise before 3.1.4 Denial of Service via text-to-speech/abortPublic exploitFlowiseAI · Flowise | Medium6.3 |
| CVE-2026-90534 | Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-methodFlowiseAI · Flowise | Medium6.1 |
| CVE-2026-90533 | Flowise before 3.1.4 Broken Access Control via organizationuserPublic exploitFlowiseAI · Flowise | Medium6.0 |
| CVE-2026-73604 | Flowise before 3.1.3 Credential Exposure via APIPublic exploitFlowiseAI · Flowise | High7.1 |
| CVE-2026-73603 | Flowise before 3.1.4 Credential Abuse via Text-to-SpeechPublic exploitFlowiseAI · Flowise | Medium6.3 |
| CVE-2026-73602 | Flowise before 3.1.3 Sandbox Escape to RCEFlowiseAI · Flowise | Critical9.0 |
| CVE-2026-73601 | Flowise before 3.1.3 Remote Code Execution via Custom MCPFlowiseAI · Flowise | Critical9.0 |
| CVE-2026-73488 | Flowise before 3.1.3 IDOR via customer-default-source endpointPublic exploitFlowiseAI · Flowise | Medium6.0 |
| CVE-2026-73487 | Flowise before 3.1.3 Prompt Injection RCE via CSV AgentPublic exploitFlowiseAI · Flowise | Critical9.0 |
| CVE-2026-73486 | Flowise before 3.1.3 Code Injection via CSV Agent customReadCSVPublic exploitFlowiseAI · Flowise | Critical9.0 |
| CVE-2026-73485 | Flowise before 3.1.3 Remote Code Execution via Airtable AgentFlowiseAI · Flowise | Critical9.0 |
| CVE-2026-73484 | Flowise before 3.1.3 Sandbox Escape via Pandas MethodsPublic exploitFlowiseAI · Flowise | High8.6 |
| CVE-2026-73483 | Flowise before 3.1.3 Sandbox Escape via PuppeteerPublic exploitFlowiseAI · Flowise | Critical9.4 |
| CVE-2026-71962 | Flowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/downloadPublic exploitFlowiseAI · Flowise | High8.7 |
| CVE-2026-67620 | Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-ListPublic exploitFlowiseAI · Flowise | Medium6.3 |
| CVE-2026-70636 | Flowise 3.1.4 Authentication Bypass via OAuth2 Credential Refresh EndpointPublic exploitFlowiseAI · Flowise | High8.7 |
| CVE-2026-67622 | Flowise 3.1.4 IDOR in OpenAI Assistants IntegrationPublic exploitFlowiseAI · Flowise | High8.5 |
| CVE-2026-67621 | Flowise 3.1.4 Missing Authorization on Document Store Mutation EndpointsPublic exploitFlowiseAI · Flowise | High7.2 |
| CVE-2026-70478 | Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected servicePublic exploitFlowiseAI · Flowise | Critical9.2 |
| CVE-2026-70477 | Flowise: CSV Agent Prompt Injection Remote Code Execution VulnerabilityPublic exploitFlowiseAI · Flowise | Critical9.5 |
| CVE-2026-70476 | Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing ManipulationPublic exploitFlowiseAI · Flowise | High8.3 |
| CVE-2026-70475 | Flowise: Missing Authorization on Execution Update EndpointPublic exploitFlowiseAI · Flowise | High7.1 |
| CVE-2026-70474 | Flowise: Cross-Workspace OAuth2 Credential Metadata LeakPublic exploitFlowiseAI · Flowise | High7.6 |
| CVE-2026-70473 | Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert historyPublic exploitFlowiseAI · Flowise | High8.3 |
| CVE-2026-70472 | Flowise: Cross-workspace credential IDOR in openai-assistants-vector-storePublic exploitFlowiseAI · Flowise | High7.1 |
| CVE-2026-70471 | Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables DisclosureFlowiseAI · Flowise | High7.1 |
| CVE-2026-70470 | Flowise: Pyodide validator Unicode homoglyph bypass leads to RCEPublic exploitFlowiseAI · Flowise | Critical9.5 |
| CVE-2026-69264 | Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validationPublic exploitFlowiseAI · Flowise | Critical9.4 |
| CVE-2026-69263 | Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)Public exploitFlowiseAI · Flowise | High8.7 |
| CVE-2026-69262 | Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow typePublic exploitFlowiseAI · Flowise | High7.1 |
| CVE-2026-69259 | Flowise RCE via SQLite Record Manager NodePublic exploitFlowiseAI · Flowise | Critical9.4 |
| CVE-2026-69258 | Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction APIPublic exploitFlowiseAI · Flowise | High8.8 |