LLangGenius

Products

Exploited and recent CVEs

• CVE-2026-123135 Medium 6.3 langgenius dify Sandbox Run __init__.py hard-coded credentials 0.2%
• CVE-2026-105762 High 8.3 Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint 0.4%
• CVE-2026-105761 High 7.1 Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers 0.2%
• CVE-2026-85022 Low 3.5 langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting 0.4%
• CVE-2026-85021 Medium 4.3 langgenius dify Splash Layout splash.tsx router.replace cross site scripting 0.5%
• CVE-2026-18632 Medium 6.3 langgenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template engine 0.4%
• CVE-2026-18266 Medium 5.4 Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability 0.3%
• CVE-2026-61461 High 8.8 Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text 0.5%
• CVE-2026-41949 Medium 5.9 Dify < 1.14.2 Authorization Bypass via File Preview Endpoint 0.4%
• CVE-2026-41948 Critical 9.4 Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access 22.7%
• CVE-2026-41947 Critical 9.1 Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints 6.0%
• CVE-2026-41950 Medium 6.5 Dify < 1.14.0 Authorization Bypass via File UUID 0.3%
• CVE-2026-42138 Medium 6.9 Dify Vulnerable to Stored XSS via SVG-file upload 0.2%
• CVE-2026-34082 Medium 5.3 Dify has IDOR in deleting someone else's chat conversation 0.2%
• CVE-2026-6619 Low 3.5 langgenius dify ImagePreview image-preview.tsx openInNewTab cross site scripting 0.2%
• CVE-2026-6618 Medium 6.3 langgenius dify ApiBasedToolSchemaParser parser.py parse_openai_plugin_json_to_tool_bundle server-side request forgery 0.2%
• CVE-2026-6617 Medium 6.3 langgenius dify ApiToolManageService api_tools_manage_service.py get_api_tool_provider_remote_schema server-side request forgery 0.2%
• CVE-2026-21866 Medium 5.1 Dify - Stored XSS in chat 0.3%
• CVE-2026-28288 Medium 5.5 Dify has a user enumeration issue 0.7%
• CVE-2026-26023 Medium 5.3 Client‑side DOM XSS in the web chat app of Dify when using echarts 0.3%
• CVE-2025-67732 High 8.4 Dify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration Endpoint 0.4%
• CVE-2025-11750 Medium 4.3 User Enumeration via Distinct Error Messages in langgenius/dify-web 0.7%
• CVE-2025-58747 Low 2.0 Dify MCP OAuth Flow Vulnerable to XSS 6.0%
• CVE-2025-59422 Medium 6.0 Dify Has Broken Access Control on Log Message Endpoint Allows Reading of Chats of Others 0.3%
• CVE-2025-3467 High 8.0 XSS Vulnerability in langgenius/dify 0.4%
• CVE-2025-3466 Critical 9.8 Unsanitized Input in langgenius/dify 0.8%
• CVE-2025-49149 Medium 5.3 Dify has XSS vulnerability 0.3%
• CVE-2025-43854 Low 2.3 DIFY vulnerable to Clickjacking Attack 0.2%
• CVE-2025-43862 High 7.6 Dify Allows Unauthorized Access and Modification of APP Orchestration 0.3%
• CVE-2025-32796 Medium 6.5 Dify Allows Unauthorized APP Enable/Disable via API 0.4%