Dify vulnerabilities

Products

• Dify 13

Newest

• dify Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text CVE-2026-61461 8.7 HighJuly 10, 2026
• dify Dify < 1.14.2 Authorization Bypass via File Preview Endpoint CVE-2026-41949 8.2 HighMay 18, 2026
• dify Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access CVE-2026-41948 EPSS 22.7% 9.3 CriticalMay 18, 2026
• dify Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints CVE-2026-41947 9.3 CriticalMay 18, 2026
• dify Dify has IDOR in deleting someone else's chat conversation CVE-2026-34082 5.3 MediumApril 20, 2026
• dify Dify - Stored XSS in chat CVE-2026-21866 5.1 MediumMarch 3, 2026
• dify Dify has a user enumeration issue CVE-2026-28288 5.5 MediumFebruary 27, 2026
• dify Client‑side DOM XSS in the web chat app of Dify when using echarts CVE-2026-26023 5.3 MediumFebruary 11, 2026
• dify Dify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration Endpoint CVE-2025-67732 8.4 HighJanuary 5, 2026
• dify Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send... CVE-2025-63387 Disputed EPSS 18.7% 4.3 MediumDecember 18, 2025
• dify Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component... CVE-2025-56520 5.3 MediumSeptember 30, 2025
• dify, langgenius langgenius/dify +1 more Server-Side Request Forgery (SSRF) in langgenius/dify CVE-2024-11822 6.5 MediumMarch 20, 2025
• dify, langgenius langgenius/dify +1 more Pandas Query Injection in langgenius/dify CVE-2025-0185 8.8 HighMarch 20, 2025