Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,313All CVEsplus 19,140 rejected
- 463Last 24 hours2,730 in the last 7 days
- 16,921Last 30 days1,560 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 8 | 7 | 9 | 1 | 0 | 25 | 25 |
| Title | ||
|---|---|---|
| CVE-2026-56271 | Flowise - Weak Default JWT Secrets in Authentication MiddlewareFlowise · Flowise | Critical9.3 |
| CVE-2026-56273 | Flowise - Path Traversal in Vector Store basePath ParameterFlowise · Flowise | Medium4.9 |
| CVE-2026-56278 | Flowise - Session Hijacking via Weak Default Express Session SecretFlowise · Flowise | Critical9.3 |
| CVE-2026-56277 | Flowise - Hardcoded CORS Wildcard in TTS EndpointFlowise · Flowise | Medium6.9 |
| CVE-2026-58057 | Flowise - Custom MCP Environment Variable Denylist Bypass via Case SensitivityFlowise · Flowise | Low2.3 |
| CVE-2025-71338 | Flowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store APIFlowise · Flowise | Critical10.0 |
| CVE-2025-71336 | Flowise - Unsandboxed Remote Code Execution via Custom MCPFlowise · Flowise | Critical9.3 |
| CVE-2025-71335 | Flowise - Session Invalidation Failure After Password ChangeFlowise · Flowise | High8.6 |
| CVE-2025-71334 | Flowise - Arbitrary File Access via Missing Chat Flow ID ValidationFlowise · Flowise | Critical9.3 |
| CVE-2025-71333 | Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments EndpointFlowise · Flowise | Critical9.3 |
| CVE-2025-71328 | Flowise - Unverified Password Change via Account SettingsFlowise · Flowise | High8.7 |
| CVE-2025-71327 | Flowise - Authentication Bypass via Unprotected Registration EndpointFlowise · Flowise | Critical9.3 |
| CVE-2025-71324 | Flowise - Arbitrary File Read via chatId ParameterFlowise · Flowise | High8.7 |
| CVE-2026-56272 | Flowise - Insufficient Password Salt Rounds in Bcrypt HashingFlowise · Flowise | Medium5.6 |
| CVE-2026-56270 | Flowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod EndpointFlowise · Flowise | High8.7 |
| CVE-2026-56269 | Flowise - Weak Default Token Hash Secret in JWT Token EncryptionFlowise · Flowise | Medium4.3 |
| CVE-2025-71332 | Flowise - SQL Injection in importChatflows API via chatflow.id ParameterFlowise · Flowise | High8.5 |
| CVE-2026-56275 | Flowise - Server-Side Request Forgery via Execute Flow Base URLFlowise · Flowise | Medium6.0 |
| CVE-2026-56274 | Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccessFlowise · Flowise | High8.7 |
| CVE-2025-71337 | Flowise - Unverified Email Change via Account Profile EndpointFlowise · Flowise | High8.7 |
| CVE-2026-56268 | Flowise - Cross-Workspace Information Disclosure via chatflows/apikey EndpointFlowise · Flowise | Medium5.3 |
| CVE-2026-56276 | Flowise - Mass Assignment in PUT /api/v1/user Allows Password Hash OverrideFlowise · Flowise | Medium6.0 |
| CVE-2026-56267 | Flowise - PII Disclosure via Unauthenticated Forgot Password EndpointFlowise · Flowise | Medium6.9 |
| CVE-2025-71331 | Flowise - Cross-Site Scripting in Chat Messages and Agent WorkflowsFlowise · Flowise | Medium5.1 |
| CVE-2024-58351 | Flowise - Remote Code Execution via overrideConfig ParameterFlowise · Flowise | Critical9.3 |