Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,898All CVEsplus 19,118 rejected
- 417Last 24 hours2,904 in the last 7 days
- 16,792Last 30 days1,550 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 27 | 63 | 12 | 0 | 0 | 102 | 120 |
| 2025 | 4 | 5 | 0 | 0 | 0 | 9 | 18 |
| 2024 | 2 | 3 | 4 | 0 | 0 | 9 | 9 |
| Title | ||
|---|---|---|
| CVE-2026-119978 | Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStoreFlowiseAI · Flowise | Critical9.0 |
| CVE-2026-100610 | Flowise through 3.1.4 Missing Authorization via upsert-historyFlowiseAI · Flowise | High7.7 |
| CVE-2026-100609 | Flowise through 3.1.4 Insecure Direct Object Reference via CredentialFlowiseAI · Flowise | High7.6 |
| CVE-2026-100608 | Flowise through 3.1.4 Authorization Bypass via BullMQ DashboardFlowiseAI · Flowise | High8.7 |
| CVE-2026-100607 | Flowise through 3.1.4 Authentication Bypass via Email-Only SSOFlowiseAI · Flowise | Critical9.2 |
| CVE-2026-100606 | Flowise through 3.1.4 Authentication Bypass via SSO Email MatchFlowiseAI · Flowise | Critical9.2 |
| CVE-2026-100605 | Flowise through 3.1.4 Missing Authorization via Chat Message RoutesFlowiseAI · Flowise | High7.5 |
| CVE-2026-91938 | Flowise before 3.1.4 Server-Side Request Forgery via document loadersFlowiseAI · Flowise | High7.6 |
| CVE-2026-91937 | Flowise before 3.1.4 NoSQL Injection via sessionIdFlowiseAI · Flowise | High8.7 |
| CVE-2026-91936 | Flowise before 3.1.4 Script Injection via Docker WorkflowsFlowiseAI · Flowise | High8.3 |
| CVE-2026-91935 | Flowise before 3.1.4 SSRF and API Key Exfiltration via Chat Model NodesFlowiseAI · Flowise | High8.7 |
| CVE-2026-91934 | Flowise before 3.1.4 Remote Code Execution via SQL Database ChainFlowiseAI · Flowise | High8.7 |
| CVE-2026-91933 | Flowise before 3.1.4 Authorization Bypass via openai-realtimeFlowiseAI · Flowise | High7.6 |
| CVE-2026-91932 | Flowise before 3.1.4 Remote Code Execution via cwd ParameterFlowiseAI · Flowise | Critical9.0 |
| CVE-2026-91931 | Flowise before 3.1.4 Remote Code Execution via Custom MCP npxFlowiseAI · Flowise | Critical9.0 |
| CVE-2026-91930 | Flowise before 3.1.4 Cross-Tenant Organization Admin TakeoverFlowiseAI · Flowise | High7.7 |
| CVE-2026-91929 | Flowise before 3.1.4 Cross-Tenant Authorization BypassFlowiseAI · Flowise | High7.6 |
| CVE-2026-90580 | FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgeryFlowiseAI · Flowise | Medium5.3 |
| CVE-2026-90535 | Flowise before 3.1.4 Denial of Service via text-to-speech/abortFlowiseAI · Flowise | Medium6.3 |
| CVE-2026-90534 | Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-methodFlowiseAI · Flowise | Medium6.1 |
| CVE-2026-90533 | Flowise before 3.1.4 Broken Access Control via organizationuserFlowiseAI · Flowise | Medium6.0 |
| CVE-2026-73604 | Flowise before 3.1.3 Credential Exposure via APIFlowiseAI · Flowise | High7.1 |
| CVE-2026-73603 | Flowise before 3.1.4 Credential Abuse via Text-to-SpeechFlowiseAI · Flowise | Medium6.3 |
| CVE-2026-73602 | Flowise before 3.1.3 Sandbox Escape to RCEFlowiseAI · Flowise | Critical9.0 |
| CVE-2026-73601 | Flowise before 3.1.3 Remote Code Execution via Custom MCPFlowiseAI · Flowise | Critical9.0 |
| CVE-2026-73488 | Flowise before 3.1.3 IDOR via customer-default-source endpointFlowiseAI · Flowise | Medium6.0 |
| CVE-2026-73487 | Flowise before 3.1.3 Prompt Injection RCE via CSV AgentFlowiseAI · Flowise | Critical9.0 |
| CVE-2026-73486 | Flowise before 3.1.3 Code Injection via CSV Agent customReadCSVFlowiseAI · Flowise | Critical9.0 |
| CVE-2026-73485 | Flowise before 3.1.3 Remote Code Execution via Airtable AgentFlowiseAI · Flowise | Critical9.0 |
| CVE-2026-73484 | Flowise before 3.1.3 Sandbox Escape via Pandas MethodsFlowiseAI · Flowise | High8.6 |
| CVE-2026-73483 | Flowise before 3.1.3 Sandbox Escape via PuppeteerFlowiseAI · Flowise | Critical9.4 |
| CVE-2026-71962 | Flowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/downloadFlowiseAI · Flowise | High8.7 |
| CVE-2026-67620 | Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-ListFlowiseAI · Flowise | Medium6.3 |
| CVE-2026-70636 | Flowise 3.1.4 Authentication Bypass via OAuth2 Credential Refresh EndpointFlowiseAI · Flowise | High8.7 |
| CVE-2026-67622 | Flowise 3.1.4 IDOR in OpenAI Assistants IntegrationFlowiseAI · Flowise | High8.5 |
| CVE-2026-67621 | Flowise 3.1.4 Missing Authorization on Document Store Mutation EndpointsFlowiseAI · Flowise | High7.2 |
| CVE-2026-70478 | Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected serviceFlowiseAI · Flowise | Critical9.2 |
| CVE-2026-70477 | Flowise: CSV Agent Prompt Injection Remote Code Execution VulnerabilityFlowiseAI · Flowise | Critical9.5 |
| CVE-2026-70476 | Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing ManipulationFlowiseAI · Flowise | High8.3 |
| CVE-2026-70475 | Flowise: Missing Authorization on Execution Update EndpointFlowiseAI · Flowise | High7.1 |
| CVE-2026-70474 | Flowise: Cross-Workspace OAuth2 Credential Metadata LeakFlowiseAI · Flowise | High7.6 |
| CVE-2026-70473 | Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert historyFlowiseAI · Flowise | High8.3 |
| CVE-2026-70472 | Flowise: Cross-workspace credential IDOR in openai-assistants-vector-storeFlowiseAI · Flowise | High7.1 |
| CVE-2026-70471 | Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables DisclosureFlowiseAI · Flowise | High7.1 |
| CVE-2026-70470 | Flowise: Pyodide validator Unicode homoglyph bypass leads to RCEFlowiseAI · Flowise | Critical9.5 |
| CVE-2026-69264 | Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validationFlowiseAI · Flowise | Critical9.4 |
| CVE-2026-69263 | Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)FlowiseAI · Flowise | High8.7 |
| CVE-2026-69262 | Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow typeFlowiseAI · Flowise | High7.1 |
| CVE-2026-69259 | Flowise RCE via SQLite Record Manager NodeFlowiseAI · Flowise | Critical9.4 |
| CVE-2026-69258 | Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction APIFlowiseAI · Flowise | High8.8 |