Vendors / flowintel Records 13 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 5
Exploited now flowintel records in CISA KEV No flowintel vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 41
Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed.
CVSS 4.0 CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00406 · Published 2026-08-27 · No fix listed CWE-384
Priority MEDIUM 40
Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint.
CVSS 4.0 HIGH 8.6· Network · High privileges · No interaction · EPSS 0.00527 · Published 2026-08-27 · No fix listed CWE-20
Priority LOW 39
Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API.
CVSS 4.0 HIGH 8.6· Network · High privileges · No interaction · EPSS 0.00388 · Published 2026-08-27 · No fix listed CWE-269
Priority LOW 37
Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Email(email).
CVSS 4.0 MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00434 · Published 2026-08-27 · No fix listed CWE-20
Priority LOW 35
Affected versions of Flowintel allow the LOG_FILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory.
CVSS 4.0 HIGH 7.5· Network · High privileges · No interaction · EPSS 0.00422 · Published 2026-08-27 · No fix listed CWE-22
Priority LOW 32
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints.
CVSS 4.0 HIGH 7.2· Network · Low privileges · No interaction · EPSS 0.00351 · Published 2026-08-27 · No fix listed CWE-639
Priority LOW 32
Affected versions of Flowintel allow attacker-controlled note content to be processed by Pandoc and XeLaTeX during PDF export in a way that can cause local files on the Flowintel server to be read and incorporated into t…
CVSS 4.0 HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00454 · Published 2026-08-27 · No fix listed CWE-22
Priority LOW 31
FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields.
CVSS 4.0 MEDIUM 6.9· Network · Low privileges · User interaction · EPSS 0.00492 · Published 2026-08-03 · No fix listed CWE-79
Priority LOW 27
FlowIntel up to version 3.3.0 contains a server-side request forgery (SSRF) vulnerability in the external reference URL probe functionality in app/case/task.py.
CVSS 4.0 MEDIUM 6.2· Network · Low privileges · User interaction · EPSS 0.00232 · Published 2026-05-28 · Fixed in 3.3.0 CWE-918
Priority LOW 24
Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user.
CVSS 4.0 MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.0047 · Published 2026-08-27 · No fix listed CWE-862
Priority LOW 24
Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup.
CVSS 4.0 MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00546 · Published 2026-08-27 · No fix listed CWE-79
Priority LOW 23
Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: * object UUID; * object name; * attribute value; * attribute type; * comment; * first/last seen values; * IDS…
CVSS 4.0 MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.0039 · Published 2026-08-27 · No fix listed CWE-79
Priority LOW 23
Affected versions of Flowintel render calendar event titles using innerHTML.
CVSS 4.0 MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00396 · Published 2026-08-27 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
1 5 7 0 0
THREATIST.IORead the docs