https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-2099.htmlhttps://patchthecve.com/cve/CVE-2026-2099.htmlWed, 17 Jun 2026 10:30:18 +0000MEDIUM 5.4: AgentFlow developed by Flowring has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to inject persistent JavaScript codes that are executed in users' browsers upon page load.https://patchthecve.com/cve/CVE-2026-2098.htmlhttps://patchthecve.com/cve/CVE-2026-2098.htmlWed, 17 Jun 2026 10:30:18 +0000MEDIUM 6.1: AgentFlow developed by Flowring has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.https://patchthecve.com/cve/CVE-2026-2097.htmlhttps://patchthecve.com/cve/CVE-2026-2097.htmlWed, 17 Jun 2026 10:30:18 +0000HIGH 8.8: Agentflow developed by Flowring has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.https://patchthecve.com/cve/CVE-2026-2096.htmlhttps://patchthecve.com/cve/CVE-2026-2096.htmlWed, 17 Jun 2026 10:30:18 +0000CRITICAL 9.8: Agentflow developed by Flowring has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents by using a specific functionality.https://patchthecve.com/cve/CVE-2026-2095.htmlhttps://patchthecve.com/cve/CVE-2026-2095.htmlWed, 17 Jun 2026 10:30:18 +0000CRITICAL 9.8: Agentflow developed by Flowring has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to exploit a specific functionality to obtain arbitrary user authentication token and log into the system as any user.https://patchthecve.com/cve/CVE-2025-3709.htmlhttps://patchthecve.com/cve/CVE-2025-3709.htmlWed, 17 Jun 2026 09:20:31 +0000CRITICAL 9.8: Agentflow from Flowring Technology has an Account Lockout Bypass vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to perform password brute force attack.