https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T19:36:55.706633+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-31829 CVE-2026-31829 — Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access 2026-10-18T19:36:55.725460+00:00

Affected: FlowiseAI Flowise

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.0.13, Flowise exposes an HTTP Node in AgentFlow and Chatflow that performs server-side HTTP requests using user-controlled URLs. By default, there are no restrictions on target hosts, including private/internal IP ranges (RFC 1918), localhost, or cloud metadata endpoints. This enables Server-Side Request Forgery (SSRF), allowing any user interacting with a publicly exposed chatflow to force the Flowise server to make requests to internal network resources that are inaccessible from the public internet. This vulnerability is fixed in 3.0.13.