How many CVEs have patched read?

2 published CVEs changed read in FlowiseAI/Flowise, in 8 distinct patches totalling 102 changed lines, between 2026 and 2026.

What is the latest CVE that changed read?

CVE-2026-70473 (Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history), published 2026-08-04, changed lines 39 to 46 of packages/server/src/enterprise/controllers/organization-user.controller.ts.

How does read compare to the rest of FlowiseAI/Flowise?

FlowiseAI/Flowise has 32 CVEs with a located fix in total; 2 of them changed read.

What do the line numbers refer to?

Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

read in FlowiseAI/Flowise: Patched by 2 CVEs

Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

CVE-2026-70473 · packages/server/src/enterprise/controllers/organization-user.controller.ts · lines 39–46 · +6 −0 in 2 hunks

High · CVSS 8.3

EPSS 0.5%2026-08-04

Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

CVE-2026-70473 · packages/server/src/enterprise/controllers/role.controller.ts · lines 27–48 · +14 −1

High · CVSS 8.3

EPSS 0.5%2026-08-04

Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

CVE-2026-70473 · packages/server/src/enterprise/controllers/workspace.controller.ts · lines 34–57 · +9 −0

High · CVSS 8.3

EPSS 0.5%2026-08-04

Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

CVE-2026-70473 · packages/server/src/enterprise/controllers/workspace-user.controller.ts · lines 30–70 · +19 −2

High · CVSS 8.3

EPSS 0.5%2026-08-04

Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store

CVE-2026-70472 · packages/server/src/enterprise/controllers/organization-user.controller.ts · lines 39–46 · +6 −0 in 2 hunks

High · CVSS 7.1

EPSS 0.5%2026-08-04

Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store

CVE-2026-70472 · packages/server/src/enterprise/controllers/role.controller.ts · lines 27–48 · +14 −1

High · CVSS 7.1

EPSS 0.5%2026-08-04

Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store

CVE-2026-70472 · packages/server/src/enterprise/controllers/workspace.controller.ts · lines 34–57 · +9 −0

High · CVSS 7.1

EPSS 0.5%2026-08-04

Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store

CVE-2026-70472 · packages/server/src/enterprise/controllers/workspace-user.controller.ts · lines 30–70 · +19 −2

High · CVSS 7.1

EPSS 0.5%2026-08-04

read

Overview

CVEs that patched it

Other functions in these files

Other hotspots in the repository

Frequently asked questions

References

Track FlowiseAI/Flowise CVEs