Vendor
Dify
13 known vulnerabilities in products by Dify, 0 of them actively exploited (CISA KEV).
Key figures
13
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-41948 | Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access | 9.4 | |
| Critical | CVE-2026-41947 | Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints | 9.1 | |
| High | CVE-2025-63387 | Dify: Incorrect Resource Transfer Between Spheres | 4.3 | |
| High | CVE-2025-0185 | Pandas Query Injection in langgenius/dify | 8.8 | |
| High | CVE-2026-61461 | Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text | 8.8 | |
| High | CVE-2026-41949 | Dify < 1.14.2 Authorization Bypass via File Preview Endpoint | 5.9 | |
| Medium | CVE-2026-28288 | Dify has a user enumeration issue | 5.3 | |
| High | CVE-2025-67732 | Dify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration Endpoint | 6.5 | |
| Medium | CVE-2025-56520 | Dify: Server-Side Request Forgery (SSRF) | 5.3 | |
| High | CVE-2024-11822 | Server-Side Request Forgery (SSRF) in langgenius/dify | 6.5 | |
| Medium | CVE-2026-26023 | Client‑side DOM XSS in the web chat app of Dify when using echarts | 6.1 | |
| Medium | CVE-2026-21866 | Dify - Stored XSS in chat | 5.4 | |
| Medium | CVE-2026-34082 | Dify has IDOR in deleting someone else's chat conversation | 4.3 |
Products
| Dify | 13 | 0 |