Project
Flowise is an open-source low-code platform for building AI agent workflows and LLM-powered applications, including its Agentflow V2 feature.
Flowise fixed a CVSS 9.8 remote-code bug in its CSV Agent with a stricter regex, then saw that filter fail through five more CVEs. It deleted the feature in June, and the patch history is a case against trusting a string filter to vet model-written code.
Reality
Google's threat intelligence group counts 18 exploited flaws a month in 2026, up from 10.5 in 2025, while zero-days rose only from eight to 11. GTIG attributes most of the added attacks to fast weaponization of disclosed n-days, so the exposure sits in the days after a patch ships.
Perspective Coverage
4 publishersReality
Google's Threat Intelligence Group counted 141 flaws exploited in the wild from January to August, while monthly disclosures doubled to 10,740. Patch teams do better sorting by that exploited set than by the total, though attackers now reach some public flaws within days.
Reality
Mysterium VPN counted 36,769 self-hosted AI endpoints reachable from the public internet. Ollama is the only population where the scan can prove that nothing on the host asked for credentials.
Reality
Rapid7 describes eleven of the sixteen additions, and eight of those are scanners rather than exploits. The unauthenticated file reads and SQL injections carry the real pressure this quarter, well ahead of the two Tenable modules.
Reality
Ninety days of Wiz honeypot telemetry shows tooling written for LiteLLM's internals, including a config test endpoint that spawns whatever command it is handed and a miner whose output comes home inside the MCP protocol.
Reality
Durable execution restores orchestration state. It cannot untake a payment, a send, or a ticket, and no ranked feature table for AutoGen, CrewAI, LangGraph or Flowise closes that gap.
Reality
The vendor reports 10-plus CVEs and up to 200,000 exposed instances, and says Anthropic declined to change the protocol, describing the behaviour as expected.
Reality