Issues

• [SECURITY] Deserialization RCE via PUT /runtime/tasks/{taskId}/variables/{variableName} with type=serializable (CWE-502, CVSS 8.1)

  flowable/flowable-engine#4293 · Filter by author Jiecub3 opened on Sep 29, 2026

• [SECURITY] Deserialization RCE via CMMN REST task variable interface with type=serializable (CWE-502, CVSS 8.8)

  flowable/flowable-engine#4292 · Filter by author Jiecub3 opened on Sep 29, 2026

• [SECURITY] Deserialization RCE via TaskVariableCollectionResource multipart endpoint with type=serializable (CWE-502, CVSS 8.8)

  flowable/flowable-engine#4291 · Filter by author Jiecub3 opened on Sep 29, 2026

• [SECURITY] Deserialization RCE via ProcessInstanceVariableResource.updateVariable (multipart) with type=serializable (CWE-502, CVSS 8.8)

  flowable/flowable-engine#4290 · Filter by author Jiecub3 opened on Sep 29, 2026

• [SECURITY] Deserialization RCE via POST /runtime/process-instances/{processInstanceId}/variables with type=serializable (CWE-502, CVSS 8.8)

  flowable/flowable-engine#4289 · Filter by author Jiecub3 opened on Sep 29, 2026

• [SECURITY] Deserialization RCE via PUT /runtime/process-instances/{processInstanceId}/variables (multipart) with type=serializable (CWE-502, CVSS 8.8)

  flowable/flowable-engine#4288 · Filter by author Jiecub3 opened on Sep 29, 2026

• [SECURITY] Deserialization RCE via ExecutionVariableCollectionResource.createExecutionVariable with type=serializable (CWE-502, CVSS 8.8)

  flowable/flowable-engine#4287 · Filter by author Jiecub3 opened on Sep 29, 2026

• [SECURITY] Deserialization RCE via PUT /runtime/executions/{executionId}/variables (multipart) with type=serializable (CWE-502, CVSS 8.8)

  flowable/flowable-engine#4286 · Filter by author Jiecub3 opened on Sep 29, 2026

• [SECURITY] Deserialization RCE via PUT /cmmn-runtime/tasks/{taskId}/variables/{variableName} with type=serializable (CWE-502, CVSS 8.8)

  flowable/flowable-engine#4285 · Filter by author Jiecub3 opened on Sep 29, 2026

• [SECURITY] Deserialization RCE via PUT /cmmn-runtime/case-instances/{caseInstanceId}/variables/{variableName} with type=serializable (CWE-502, CVSS 8.8)

  flowable/flowable-engine#4284 · Filter by author Jiecub3 opened on Sep 29, 2026

• [SECURITY] Deserialization RCE via PUT /cmmn-runtime/case-instances/{caseInstanceId}/variables with type=serializable (CWE-502, CVSS 8.8)

  flowable/flowable-engine#4283 · Filter by author Jiecub3 opened on Sep 29, 2026

• Authorization Bypass Through User-Controlled Key in the External-Worker Job API

  flowable/flowable-engine#4282 · Filter by author CyanM0un opened on Sep 28, 2026

• Improper Privilege Management in the Flowable IDM REST API

  flowable/flowable-engine#4281 · Filter by author CyanM0un opened on Sep 28, 2026

• [SECURITY] Deserialization RCE via CMMN REST PlanItemInstance variable endpoint with type=serializable (CWE-502, CVSS 8.1)

  flowable/flowable-engine#4280 · Filter by author Jiecub3 opened on Sep 22, 2026
  2

• [SECURITY] Deserialization RCE via PUT /runtime/executions/{executionId}/variables with type=serializable (CWE-502, CVSS 8.8)

  flowable/flowable-engine#4279 · Filter by author Jiecub3 opened on Sep 22, 2026
  2

• [SECURITY] Java deserialization of type=serializable REST variables (CVSS 8.0), unsandboxed deployable artifacts, order-column SQLi, HTTP-task SSRF

  flowable/flowable-engine#4272 · Filter by author Ve1ledJustice opened on Sep 7, 2026
  1

• Item reference is invalid - when relying on target namespace, or when using explicit namespace

  flowable/flowable-engine#4269 · Filter by author pdinc-oss opened on Sep 1, 2026
  1

• FlowableMultiInstanceActivityEventImpl#isSequential() typo issue

  flowable/flowable-engine#4268 · Filter by author chuntungho opened on Aug 29, 2026

• SQL injection in /management/tables/{tableName}/data via orderAscendingColumn/orderDescendingColumn

  flowable/flowable-engine#4260 · Filter by author EaEa0001 opened on Aug 18, 2026

• XML External Entity (XXE) injection in ProcessDiagramLayoutFactory

  flowable/flowable-engine#4216 · Filter by author geo-chen opened on Jun 15, 2026

• registerTenant deadlocks on SQL Server when called post-boot

  flowable/flowable-engine#4215 · Filter by author sherter opened on Jun 3, 2026

• BPMN schema validation fails when Flowable jar is loaded from a non-ASCII unpacked Spring Boot classpath

  flowable/flowable-engine#4214 · Filter by author li-zhixin opened on Jun 2, 2026

• "Full" history level for variable changes doesn't implemented in CMMN

  flowable/flowable-engine#4201 · Filter by author JohnnySong opened on Apr 10, 2026
  1

• Suspended definition with signal start event blocks active one with same event

  flowable/flowable-engine#4194 · Filter by author martin-grofcik opened on Mar 26, 2026

• NullPointerException in ParallelMultiInstanceBehavior.leave() when completing a user task (execution is null in setLoopVariable)

  flowable/flowable-engine#4184 · Filter by author austin-2020 opened on Mar 14, 2026
  1