ALL POSTS

Flowise AI Agent Builder Faces Critical CVSS 10.0 RCE Vulnerability With 12,000+ Exposed Instances Under Active Exploitation

Key Findings CVE-2025-59528, a maximum-severity code injection vulnerability (CVSS 10.0), is being actively exploited against Flowise, an open-source AI platform The flaw allows remote code execution with only an API token required for exploitation Over 12,000 Flowise instances are exposed and vulnerable to attack Exploitation activity has been confirmed originating from a single Starlink IP address The vulnerability was patched in version 3.0.6 but remains unpatched on thous

Apr 72 min read

Critical Flowise Flaw Allows Unauthenticated Remote Access

Key Findings: Flowise, a popular open-source low-code workflow platform, contains a critical vulnerability allowing unauthenticated remote admin takeover. The vulnerability is due to an exposed registration endpoint that can be exploited to gain full administrative control of the Flowise instance. No authentication is required to leverage this flaw, making it trivial for attackers to gain complete control of affected systems. The vulnerability has been assigned the CVE identi

Nov 18, 20252 min read