What’s Vulnerable › Products
langgenius dify vulnerabilities
36 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 27 published in the last 12 months.
Check whether your langgenius dify version is affected
Latest langgenius dify vulnerabilities
- CVE-2026-105762 — Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint (CVSS 8.3)
- CVE-2026-105761 — Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers (CVSS 7.1)
- CVE-2026-85022 — langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting (CVSS 3.5)
- CVE-2026-85021 — langgenius dify Splash Layout splash.tsx router.replace cross site scripting (CVSS 4.3)
- CVE-2026-18632 — langgenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template engine (CVSS 6.3)
- CVE-2026-18266 — Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability (CVSS 5.4)
- CVE-2026-41950 — Dify < 1.14.0 Authorization Bypass via File UUID (CVSS 6.5)
- CVE-2026-42138 — Dify Vulnerable to Stored XSS via SVG-file upload (CVSS 6.1)
- CVE-2026-6619 — langgenius dify ImagePreview image-preview.tsx openInNewTab cross site scripting (CVSS 3.5)
- CVE-2026-6618 — langgenius dify ApiBasedToolSchemaParser parser.py parse_openai_plugin_json_to_tool_bundle server-side request forgery (CVSS 6.3)
- CVE-2026-6617 — langgenius dify ApiToolManageService api_tools_manage_service.py get_api_tool_provider_remote_schema server-side request forgery (CVSS 6.3)
- CVE-2025-63387 — (CVSS 7.5)
- CVE-2025-56157 — (CVSS 9.8)
- CVE-2025-63388 — (CVSS 9.1)
- CVE-2025-63386 — (CVSS 9.1)
- CVE-2025-11750 — User Enumeration via Distinct Error Messages in langgenius/dify-web (CVSS 5.3)
- CVE-2025-58747 — Dify MCP OAuth Flow Vulnerable to XSS (CVSS 6.1)
- CVE-2025-59422 — Dify Has Broken Access Control on Log Message Endpoint Allows Reading of Chats of Others (CVSS 3.1)
- CVE-2025-3467 — XSS Vulnerability in langgenius/dify (CVSS 5.4)
- CVE-2025-3466 — Unsanitized Input in langgenius/dify (CVSS 7.2)
- CVE-2025-49149 — Dify has XSS vulnerability (CVSS 6.1)
- CVE-2025-43854 — DIFY vulnerable to Clickjacking Attack (CVSS 6.1)
- CVE-2025-43862 — Dify Allows Unauthorized Access and Modification of APP Orchestration (CVSS 7.6)
- CVE-2025-32796 — Dify Allows Unauthorized APP Enable/Disable via API (CVSS 6.5)
- CVE-2025-32795 — Dify Allows Insecure User Role Access Control for APP Editing (CVSS 6.5)