https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 21:47:18 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-325661 EUVD-2026-325661 https://cve.radiocsirt.org/vuln/euvd-2026-325661 https://cve.radiocsirt.org/vuln/fkie_cve-2026-46440 <p>Flowise is a drag &amp; drop user interface to build a customized large language model flow. Prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison. This issue has been patched in version 3.1.2.</p> <p>Flowise is a drag &amp; drop user interface to build a customized large language model flow. Prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison. This issue has been patched in version 3.1.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-46440 https://cve.radiocsirt.org/vuln/ghsa-php6-83fg-gw3g <p><strong>Affected:</strong> npm: flowise</p> <p>**Detection Method:** Kolega.dev Deep Code Scan</p> <p>| Attribute | Value | |---|---| | Severity | Medium | | CWE | CWE-522 (Insufficiently Protected Credentials) | | Location | packages/server/src/enterprise/controllers/account.controller.ts:128-135 | | Practical Exploitability | Medium | | Developer Approver | faizan@kolega.ai |</p> <p>### Description The checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison.</p> <p>### Affected Code ``` public async checkBasicAuth(req: Request, res: Response) { const { username, password } = req.body if (username === process.env.FLOWISE_USERNAME &amp;&amp; password === process.env.FLOWISE_PASSWORD) { return res.json({ message: &#39;Authentication successful&#39; }) ```</p> <p>### Evidence Credentials are sent in plaintext in request body and compared directly without hashing. No rate limiting prevents brute force attacks. The endpoint returns different messages for success/failure, enabling enumeration.</p> <p>### Impact Credential brute-forcing - attackers can attempt unlimited username/password combinations against the basic auth system. Successful attacks grant access to the application.</p> <p>### Recommendation 1) Implement rate limiting on this endpoint, 2) Use constant-time comparison to prevent timing attacks, 3) Consider using hashed comparison, 4) Return generic error messages, 5) Add logging for failed attempts.</p> <p>### Notes The checkBasicAuth endpoint at line 128-135 has multiple security issues: (1) No rate l…</p> <p><strong>Affected:</strong> npm: flowise</p> <p>**Detection Method:** Kolega.dev Deep Code Scan</p> <p>| Attribute | Value | |---|---| | Severity | Medium | | CWE | CWE-522 (Insufficiently Protected Credentials) | | Location | packages/server/src/enterprise/controllers/account.controller.ts:128-135 | | Practical Exploitability | Medium | | Developer Approver | faizan@kolega.ai |</p> <p>### Description The checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison.</p> <p>### Affected Code ``` public async checkBasicAuth(req: Request, res: Response) { const { username, password } = req.body if (username === process.env.FLOWISE_USERNAME &amp;&amp; password === process.env.FLOWISE_PASSWORD) { return res.json({ message: &#39;Authentication successful&#39; }) ```</p> <p>### Evidence Credentials are sent in plaintext in request body and compared directly without hashing. No rate limiting prevents brute force attacks. The endpoint returns different messages for success/failure, enabling enumeration.</p> <p>### Impact Credential brute-forcing - attackers can attempt unlimited username/password combinations against the basic auth system. Successful attacks grant access to the application.</p> <p>### Recommendation 1) Implement rate limiting on this endpoint, 2) Use constant-time comparison to prevent timing attacks, 3) Consider using hashed comparison, 4) Return generic error messages, 5) Add logging for failed attempts.</p> <p>### Notes The checkBasicAuth endpoint at line 128-135 has multiple security issues: (1) No rate l…</p> https://cve.radiocsirt.org/vuln/ghsa-php6-83fg-gw3g https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1554 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um Code auszuführen, Objekte anderer Benutzer zu übernehmen, Informationen offenzulegen und weitere, nicht näher genannte Auswirkungen zu erzielen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um Code auszuführen, Objekte anderer Benutzer zu übernehmen, Informationen offenzulegen und weitere, nicht näher genannte Auswirkungen zu erzielen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1554