CVE-2026-2098

AgentFlow developed by Flowring has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.

Score

CVSS 3.1 6.1 Medium

Status

Analyzed - twcert@cert.org.tw

Published

2026-02-10

Last modified

2026-02-10

Weaknesses

CWE-79

Affected products

• Agentflow (Flowring)

References

• https://www.twcert.org.tw/en/cp-139-10700-3534d-2.html
• https://www.twcert.org.tw/tw/cp-132-10699-49c0b-1.html