Advisories · Technology
langgenius dify.
Every CVE that names langgenius dify among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
langgenius dify Sandbox Run __init__.py hard-coded credentials
- langgenius dify
- Hard-coded credentials
- CVSS 8.3 High
Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint
- langgenius dify
- Server-side request forgery (SSRF)
- CVSS 7.1 High
Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers
- langgenius dify
- Broken access control
- CVSS 5.1 Medium
langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting
- langgenius dify
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
langgenius dify Splash Layout splash.tsx router.replace cross site scripting
- langgenius dify
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
langgenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template engine
- langgenius dify
- Code injection
- CWE-791
- CVSS 5.4 Medium
Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability
- LangGenius Dify
- Open redirect
- CVSS 8.7 High
Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text
- langgenius dify
- SQL injection
- CVSS 8.2 High
Dify < 1.14.2 Authorization Bypass via File Preview Endpoint
- langgenius dify
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access
- langgenius dify
- Path traversal
- CVSS 9.3 CriticalCritical · CVSS 9+
Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints
- langgenius dify
- Broken access control
- CVSS 6.0 Medium
Dify < 1.14.0 Authorization Bypass via File UUID
- langgenius dify
- Broken access control
- CVSS 6.9 Medium
Dify Vulnerable to Stored XSS via SVG-file upload
- langgenius dify
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Dify has IDOR in deleting someone else's chat conversation
- langgenius dify
- Broken access control
- CVSS 5.1 Medium
langgenius dify ImagePreview image-preview.tsx openInNewTab cross site scripting
- langgenius dify
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
langgenius dify ApiBasedToolSchemaParser parser.py parse_openai_plugin_json_to_tool_bundle server-side request forgery
- langgenius dify
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
langgenius dify ApiToolManageService api_tools_manage_service.py get_api_tool_provider_remote_schema server-side request forgery
- langgenius dify
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
Dify - Stored XSS in chat
- langgenius dify
- Cross-site scripting (XSS)
- CVSS 5.5 Medium
Dify has a user enumeration issue
- langgenius dify
- CWE-204
- CVSS 5.3 Medium
Client‑side DOM XSS in the web chat app of Dify when using echarts
- langgenius dify
- Cross-site scripting (XSS)
- CVSS 8.4 High
Dify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration Endpoint
- langgenius dify
- Information disclosure
- Hard-coded credentials
- CVSS 4.3 Medium
User Enumeration via Distinct Error Messages in langgenius/dify-web
- langgenius/dify
- CWE-544
- CVSS 2.0 Low
Dify MCP OAuth Flow Vulnerable to XSS
- langgenius dify
- Cross-site scripting (XSS)
- CVSS 6.0 Medium
Dify Has Broken Access Control on Log Message Endpoint Allows Reading of Chats of Others
- langgenius dify
- Broken access control
- CVSS 8.0 High
XSS Vulnerability in langgenius/dify
- langgenius/dify
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
Unsanitized Input in langgenius/dify
- langgenius/dify
- CWE-1100
- CVSS 5.3 Medium
Dify has XSS vulnerability
- langgenius dify
- Cross-site scripting (XSS)
- CVSS 2.3 Low
DIFY vulnerable to Clickjacking Attack
- langgenius dify
- CWE-1021
- CVSS 7.6 High
Dify Allows Unauthorized Access and Modification of APP Orchestration
- langgenius dify
- Broken access control
- CVSS 6.5 Medium
Dify Allows Unauthorized APP Enable/Disable via API
- langgenius dify
- Broken access control
- CVSS 6.5 Medium
Dify Allows Insecure User Role Access Control for APP Editing
- langgenius dify
- Broken access control
- CVSS 6.3 Medium
Dify Allows Insecure User Role Access Control for APP DSL Exporting
- langgenius dify
- Broken access control
- CVSS 6.5 Medium
Server-Side Request Forgery (SSRF) in langgenius/dify
- langgenius/dify
- Server-side request forgery (SSRF)
- CVSS 6.8 Medium
Stored XSS in langgenius/dify
- langgenius/dify
- Cross-site scripting (XSS)
- CVSS 8.1 High
Authentication Bypass in langgenius/dify
- langgenius/dify
- CWE-305
- CVSS 8.8 High
Code Injection in langgenius/dify
- langgenius/dify
- Code injection
- CVSS 7.4 High
Improper Restriction of Excessive Authentication Attempts in langgenius/dify
- langgenius/dify
- Authentication bypass
- CVSS 6.5 Medium
SSRF in langgenius/dify
- langgenius/dify
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Server-Side Request Forgery (SSRF) in langgenius/dify
- langgenius/dify
- Server-side request forgery (SSRF)
- CVSS 8.8 High
Pandas Query Injection in langgenius/dify
- langgenius/dify
- Code injection
- CVSS 5.8 Medium
Stored XSS in langgenius/dify
- langgenius/dify
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Privilege Escalation in langgenius/dify
- langgenius/dify
- Privilege escalation
- CVSS 7.5 High
Admin account takeover through weak Pseudo-Random number generator used in generating password reset codes in langgenius/dify
- langgenius/dify
- Weak cryptography or TLS