Skip to content
Langgenius Dify vulnerabilities
-
langgenius dify
Dify < 1.15.0 SSRF Protection Bypass via Remote-Files Endpoints
CVE-2026-58141
7.2 High
-
langgenius dify
langgenius dify Sandbox Run __init__.py hard-coded credentials
CVE-2026-123135
5.3 Medium
-
langgenius dify
Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint
CVE-2026-105762
8.3 High
-
langgenius dify
Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers
CVE-2026-105761
7.1 High
-
langgenius dify
langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting
CVE-2026-85022
5.1 Medium
-
langgenius dify
langgenius dify Splash Layout splash.tsx router.replace cross site scripting
CVE-2026-85021
5.3 Medium
-
langgenius dify
langgenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template engine
CVE-2026-18632
5.3 Medium
-
langgenius dify
Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability
CVE-2026-18266
5.4 Medium
-
dify
Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text
CVE-2026-61461
8.7 High
-
dify
Dify < 1.14.2 Authorization Bypass via File Preview Endpoint
CVE-2026-41949
8.2 High
-
dify
Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access
CVE-2026-41948
EPSS 22.7%
9.3 Critical
-
dify
Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints
CVE-2026-41947
9.3 Critical
-
langgenius dify
Dify < 1.14.0 Authorization Bypass via File UUID
CVE-2026-41950
6.0 Medium
-
langgenius dify
Dify Vulnerable to Stored XSS via SVG-file upload
CVE-2026-42138
6.9 Medium
-
dify
Dify has IDOR in deleting someone else's chat conversation
CVE-2026-34082
5.3 Medium
-
langgenius dify
langgenius dify ImagePreview image-preview.tsx openInNewTab cross site scripting
CVE-2026-6619
5.1 Medium
-
langgenius dify
langgenius dify ApiBasedToolSchemaParser parser.py parse_openai_plugin_json_to_tool_bundle server-side request forgery
CVE-2026-6618
5.3 Medium
-
langgenius dify
langgenius dify ApiToolManageService api_tools_manage_service.py get_api_tool_provider_remote_schema server-side request forgery
CVE-2026-6617
5.3 Medium
-
dify
Dify - Stored XSS in chat
CVE-2026-21866
5.1 Medium
-
dify
Dify has a user enumeration issue
CVE-2026-28288
5.5 Medium
-
dify
Client‑side DOM XSS in the web chat app of Dify when using echarts
CVE-2026-26023
5.3 Medium
-
dify
Dify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration Endpoint
CVE-2025-67732
8.4 High
-
langgenius dify
A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in...
CVE-2025-63388
Disputed
9.1 Critical
-
dify
Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send...
CVE-2025-63387
Disputed
EPSS 18.7%
4.3 Medium
-
langgenius dify
A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in...
CVE-2025-63386
Disputed
9.1 Critical
-
langgenius dify
Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker...
CVE-2025-56157
9.8 Critical
-
langgenius dify, langgenius/dify +1 more
User Enumeration via Distinct Error Messages in langgenius/dify-web
CVE-2025-11750
4.3 Medium
-
langgenius dify
Dify MCP OAuth Flow Vulnerable to XSS
CVE-2025-58747
2.0 Low
-
langgenius dify
Dify Has Broken Access Control on Log Message Endpoint Allows Reading of Chats of Others
CVE-2025-59422
6.0 Medium
-
langgenius dify, langgenius/dify +1 more
XSS Vulnerability in langgenius/dify
CVE-2025-3467
8.0 High
-
langgenius dify, langgenius/dify +1 more
Unsanitized Input in langgenius/dify
CVE-2025-3466
9.8 Critical
-
langgenius dify
Dify has XSS vulnerability
CVE-2025-49149
5.3 Medium
-
langgenius dify
DIFY vulnerable to Clickjacking Attack
CVE-2025-43854
2.3 Low
-
langgenius dify
Dify Allows Unauthorized Access and Modification of APP Orchestration
CVE-2025-43862
7.6 High
-
langgenius dify
Dify Allows Unauthorized APP Enable/Disable via API
CVE-2025-32796
6.5 Medium
-
langgenius dify
Dify Allows Insecure User Role Access Control for APP Editing
CVE-2025-32795
6.5 Medium
-
langgenius dify
Dify Allows Insecure User Role Access Control for APP DSL Exporting
CVE-2025-32790
6.3 Medium
-
langgenius dify
Dify v1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component...
CVE-2025-29720
4.8 Medium
-
langgenius dify, langgenius/dify +1 more
Server-Side Request Forgery (SSRF) in langgenius/dify
CVE-2025-0184
Public exploit
6.5 Medium
-
langgenius dify, langgenius/dify +1 more
Stored XSS in langgenius/dify
CVE-2024-11850
6.8 Medium
-
langgenius dify, langgenius/dify +1 more
Authentication Bypass in langgenius/dify
CVE-2024-12776
8.1 High
-
langgenius dify, langgenius/dify +1 more
Code Injection in langgenius/dify
CVE-2024-10252
8.8 High
-
langgenius dify, langgenius/dify +1 more
Improper Restriction of Excessive Authentication Attempts in langgenius/dify
CVE-2024-12039
7.4 High
-
langgenius dify, langgenius/dify +1 more
SSRF in langgenius/dify
CVE-2024-12775
6.5 Medium
-
dify, langgenius langgenius/dify +1 more
Server-Side Request Forgery (SSRF) in langgenius/dify
CVE-2024-11822
6.5 Medium
-
dify, langgenius langgenius/dify +1 more
Pandas Query Injection in langgenius/dify
CVE-2025-0185
8.8 High
-
langgenius dify, langgenius/dify +1 more
Stored XSS in langgenius/dify
CVE-2024-11824
5.8 Medium
-
langgenius dify, langgenius/dify +1 more
Privilege Escalation in langgenius/dify
CVE-2024-11821
4.3 Medium
-
langgenius dify, langgenius/dify +1 more
Admin account takeover through weak Pseudo-Random number generator used in generating password reset codes in langgenius/dify
CVE-2025-1796
7.5 High