Flowise

Search everything

Mentions · 7d0
Mentions · 30d1
All mentions2
First seenSep 9, 2026
Last mentioned20d ago

Timeline

2 articles · newest first

Attacker probes Flowise honeypot for credentials and workflow hijacking

Sekoia’s emulated Flowise 2.2.8 captured credential queries and prompt injection, without proof of production theft.

GBHackersOct 22, 09:26 UTC · 20d agoAI safety & securityCVE-2025-59528 CVE-2026-412642 · 1 read

ZDI-26-634: Flowise CSV Agent Prompt Injection Remote Code Execution Vulnerability

ZDI disclosed a CVSS 9.8 unauthenticated prompt injection vulnerability in Flowise's CSV agent that allows remote arbitrary code execution.

ZDI Published AdvisoriesSep 9, 05:00 UTC · Sep 9, 2026AdvisoryCVE-2026-704771 · 1 read

Related CVEs

by mentions

CVE-2025-5952887%10.0
Critical Unauthenticated RCE in Flowise AI Agent Builder
published Sep 22, 2025flowiseai flowisePoC ×3
CVE-2026-70477<1%9.5
Flowise: A prompt injection sent to a chatflow using a CSV Agent node can cause the LLM to respond with a malicious Python script that…
published Aug 4, 2026flowiseai flowise
CVE-2026-412642%9.2
Flowise: The specific flaw exists within the run method of the CSV_Agents class. The issue results from the lack of proper sandboxing when…
published Apr 23, 2026flowiseai flowisePoC

Appears with

Zero Day Initiativeorganization · 1
Sekoiaorganization · 1
Flowiseproduct · 1
Zero Day Initiativevendor · 1

Entities are extracted by the model from each article. First seen Sep 9, 2026, last mentioned 20d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.