https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T08:26:35.316275+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-331741 EUVD-2026-331741 2026-10-04T08:26:35.320445+00:00 EUVD-2026-331741 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56278 fkie_cve-2026-56278 2026-10-04T08:26:35.320486+00:00

Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the express-session middleware when the EXPRESS_SESSION_SECRET environment variable is not set (packages/server/src/enterprise/middleware/passport/index.ts). Because this default secret is publicly visible in the source code, an attacker can forge valid signed session cookies to impersonate any user and bypass authentication.

 https://cve.radiocsirt.org/vuln/ghsa-c973-v3cg-wcw4 GHSA-c973-v3cg-wcw4 2026-10-04T08:26:35.320536+00:00

Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the express-session middleware when the EXPRESS_SESSION_SECRET environment variable is not set (packages/server/src/enterprise/middleware/passport/index.ts). Because this default secret is publicly visible in the source code, an attacker can forge valid signed session cookies to impersonate any user and bypass authentication.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1145 WID-SEC-W-2026-1145 — Flowise: Mehrere Schwachstellen 2026-10-04T08:26:35.320569+00:00

Ein Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um Dateien zu manipulieren.