Issues

• Submit #999720: Flowable Flowable BPM Engine 7.x 全量；flowable5-engine (org.activiti 兼容层) 5.x import unguarded dynamic class load remote code execution🔓info

  flowable/flowable-engine#4314 · Filter by author onlyeagle opened on Oct 25, 2026

• Flowable Flowable BPM Engine 7.x；flowable5-engine 5.x missing authorization remote code execution

  flowable/flowable-engine#4313 · Filter by author onlyeagle opened on Oct 25, 2026

• BpmnModel#addEscalation method implement error

  flowable/flowable-engine#4306 · Filter by author delongxu opened on Oct 12, 2026
  2

• Intermittent EmptyStackException during CDI bean resolution with Weld and asynchronous jobs

  flowable/flowable-engine#4302 · Filter by author mlarue opened on Oct 8, 2026

• Jackson 3.0.1 (tools.jackson.core) in Flowable 8.0.0 has several HIGH CVEs, please upgrade to ≥ 3.1.7

  flowable/flowable-engine#4300 · Filter by author pmusy opened on Oct 7, 2026

• [SECURITY] Deserialization RCE via PUT /runtime/tasks/{taskId}/variables/{variableName} with type=serializable (CWE-502, CVSS 8.1)

  flowable/flowable-engine#4293 · Filter by author Jiecub3 opened on Sep 29, 2026

• [SECURITY] Deserialization RCE via CMMN REST task variable interface with type=serializable (CWE-502, CVSS 8.8)

  flowable/flowable-engine#4292 · Filter by author Jiecub3 opened on Sep 29, 2026

• [SECURITY] Deserialization RCE via TaskVariableCollectionResource multipart endpoint with type=serializable (CWE-502, CVSS 8.8)

  flowable/flowable-engine#4291 · Filter by author Jiecub3 opened on Sep 29, 2026

• [SECURITY] Deserialization RCE via ProcessInstanceVariableResource.updateVariable (multipart) with type=serializable (CWE-502, CVSS 8.8)

  flowable/flowable-engine#4290 · Filter by author Jiecub3 opened on Sep 29, 2026

• [SECURITY] Deserialization RCE via POST /runtime/process-instances/{processInstanceId}/variables with type=serializable (CWE-502, CVSS 8.8)

  flowable/flowable-engine#4289 · Filter by author Jiecub3 opened on Sep 29, 2026

• [SECURITY] Deserialization RCE via PUT /runtime/process-instances/{processInstanceId}/variables (multipart) with type=serializable (CWE-502, CVSS 8.8)

  flowable/flowable-engine#4288 · Filter by author Jiecub3 opened on Sep 29, 2026

• [SECURITY] Deserialization RCE via ExecutionVariableCollectionResource.createExecutionVariable with type=serializable (CWE-502, CVSS 8.8)

  flowable/flowable-engine#4287 · Filter by author Jiecub3 opened on Sep 29, 2026

• [SECURITY] Deserialization RCE via PUT /runtime/executions/{executionId}/variables (multipart) with type=serializable (CWE-502, CVSS 8.8)

  flowable/flowable-engine#4286 · Filter by author Jiecub3 opened on Sep 29, 2026

• [SECURITY] Deserialization RCE via PUT /cmmn-runtime/tasks/{taskId}/variables/{variableName} with type=serializable (CWE-502, CVSS 8.8)

  flowable/flowable-engine#4285 · Filter by author Jiecub3 opened on Sep 29, 2026

• [SECURITY] Deserialization RCE via PUT /cmmn-runtime/case-instances/{caseInstanceId}/variables/{variableName} with type=serializable (CWE-502, CVSS 8.8)

  flowable/flowable-engine#4284 · Filter by author Jiecub3 opened on Sep 29, 2026

• [SECURITY] Deserialization RCE via PUT /cmmn-runtime/case-instances/{caseInstanceId}/variables with type=serializable (CWE-502, CVSS 8.8)

  flowable/flowable-engine#4283 · Filter by author Jiecub3 opened on Sep 29, 2026

• Authorization Bypass Through User-Controlled Key in the External-Worker Job API

  flowable/flowable-engine#4282 · Filter by author CyanM0un opened on Sep 28, 2026

• Improper Privilege Management in the Flowable IDM REST API

  flowable/flowable-engine#4281 · Filter by author CyanM0un opened on Sep 28, 2026

• [SECURITY] Deserialization RCE via CMMN REST PlanItemInstance variable endpoint with type=serializable (CWE-502, CVSS 8.1)

  flowable/flowable-engine#4280 · Filter by author Jiecub3 opened on Sep 22, 2026
  2

• [SECURITY] Deserialization RCE via PUT /runtime/executions/{executionId}/variables with type=serializable (CWE-502, CVSS 8.8)

  flowable/flowable-engine#4279 · Filter by author Jiecub3 opened on Sep 22, 2026
  2

• [SECURITY] Java deserialization of type=serializable REST variables (CVSS 8.0), unsandboxed deployable artifacts, order-column SQLi, HTTP-task SSRF

  flowable/flowable-engine#4272 · Filter by author Ve1ledJustice opened on Sep 7, 2026
  1

• Item reference is invalid - when relying on target namespace, or when using explicit namespace

  flowable/flowable-engine#4269 · Filter by author pdinc-oss opened on Sep 1, 2026
  1

• FlowableMultiInstanceActivityEventImpl#isSequential() typo issue

  flowable/flowable-engine#4268 · Filter by author chuntungho opened on Aug 29, 2026

• SQL injection in /management/tables/{tableName}/data via orderAscendingColumn/orderDescendingColumn

  flowable/flowable-engine#4260 · Filter by author EaEa0001 opened on Aug 18, 2026

• XML External Entity (XXE) injection in ProcessDiagramLayoutFactory

  flowable/flowable-engine#4216 · Filter by author geo-chen opened on Jun 15, 2026