Product by LangGenius

    LangGenius Dify

    49 known vulnerabilities in LangGenius Dify (LangGenius), 0 of them actively exploited (CISA KEV).

    Key figures

    49

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    6

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in LangGenius Dify (LangGenius)
    CriticalCVE-2026-41948

    Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access

    also in 1 other product

    		9.4
    CriticalCVE-2026-41947

    Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints

    also in 1 other product

    		9.1
    MediumCVE-2025-58747

    Dify MCP OAuth Flow Vulnerable to XSS

    		6.1
    HighCVE-2025-63387

    Dify: Incorrect Resource Transfer Between Spheres

    also in 1 other product

    		4.3
    CriticalCVE-2025-56157

    LangGenius Dify: security vulnerability

    		9.8
    HighCVE-2025-0185

    Pandas Query Injection in langgenius/dify

    also in 2 other products

    		8.8
    CriticalCVE-2025-3466

    Unsanitized Input in langgenius/dify

    also in 1 other product

    		9.8
    HighCVE-2026-105762

    Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint

    		8.3
    HighCVE-2024-10252

    Code Injection in langgenius/dify

    also in 1 other product

    		8.8
    HighCVE-2026-61461

    Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text

    also in 1 other product

    		8.8
    HighCVE-2024-12776

    Authentication Bypass in langgenius/dify

    also in 1 other product

    		8.1
    HighCVE-2026-41949

    Dify < 1.14.2 Authorization Bypass via File Preview Endpoint

    also in 1 other product

    		5.9
    HighCVE-2026-58141

    Dify < 1.15.0 SSRF Protection Bypass via Remote-Files Endpoints

    		7.6
    HighCVE-2024-12039

    Improper Restriction of Excessive Authentication Attempts in langgenius/dify

    also in 1 other product

    		7.4
    HighCVE-2026-105761

    Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers

    		7.1
    MediumCVE-2026-85021

    langgenius dify Splash Layout splash.tsx router.replace cross site scripting

    		4.3
    HighCVE-2025-1796

    Langgenius/dify: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

    also in 1 other product

    		7.5
    MediumCVE-2026-28288

    Dify has a user enumeration issue

    also in 1 other product

    		5.3
    MediumCVE-2026-18632

    LangGenius Dify: Incomplete Filtering of Special Elements

    		6.3
    MediumCVE-2024-12775

    SSRF in langgenius/dify

    also in 1 other product

    		6.5
    HighCVE-2025-67732

    Dify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration Endpoint

    also in 1 other product

    		6.5
    MediumCVE-2026-123135

    langgenius dify Sandbox Run __init__.py hard-coded credentials

    		6.3
    HighCVE-2024-11822

    Server-Side Request Forgery (SSRF) in langgenius/dify

    also in 2 other products

    		6.5
    CriticalCVE-2025-63386

    LangGenius Dify: security vulnerability

    		9.1
    CriticalCVE-2025-63388

    LangGenius Dify: security vulnerability

    		9.1

    All vulnerabilities in search

    All products by LangGenius