{"data":{"id":"18dc342d-a32c-4275-a8bb-13e9a0a2e14d","title":"CVE-2026-41275: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the password…","summary":"Flowise, a drag-and-drop interface for building customized LLM flows, prior to 3.1.0 sends password reset links on cloud.flowiseai.com over unsecured HTTP instead of HTTPS. An attacker on the same network, such as public Wi-Fi, can intercept the reset link and take over the victim's account.","solution":"Fixed in 3.1.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41275","publishedAt":"2026-04-23T20:16:16.117Z","cveId":"CVE-2026-41275","cweIds":["CWE-319"],"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["flowise@<= 3.0.13 (fixed: 3.1.0)"],"affectedPackageNames":["flowise"],"affectedPackageRefs":["npm:flowise"],"affectedVendors":[],"affectedVendorsRaw":["Flowise","cloud.flowiseai.com"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Flowise password reset sends reset link over unsecured HTTP","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00176,"epssCheckedAt":"2026-11-10T00:11:23.986Z","kevDateAdded":null,"advisoryAliases":["GHSA-x5w6-38gp-mrqh"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:49:12.947Z","patchAvailable":true,"disclosureDate":"2026-04-23T20:16:16.117Z","fixReleasedAt":"2026-03-16T14:47:16.783Z","daysToFix":-38,"fixCheckedAt":"2026-10-29T21:37:30.071Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"flowise","fixedVersion":"3.1.0","matchedVersion":"3.1.0","fixReleasedAt":"2026-03-16T14:47:16.783Z","daysToFix":-38,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:37:29.924Z"}]}}