CVE-2026-91932

High8.5Published on September 15, 2026

Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code execution through an unvalidated cwd parameter. Attackers can bypass path validation using clean filenames in the args array while controlling the working directory to execute malicious code.

CVSS score8.5 / 10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness type (CWE)CWE-20

Vulnerabilities

Exploited Cisco ISE Flaw Leads a Wave of Attacks on Trusted Software Channels

Active exploitation of a critical Cisco ISE flaw highlights attacks through trusted software channels, Orkes, Discourse, libheif and AI plugins.

Sep 21, 202617:436 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Related articles

Exploited Cisco ISE Flaw Leads a Wave of Attacks on Trusted Software Channels