agentprime: langgenius-difyEvery new CVE for langgenius-dify.https://agentprime.io/CVE-2026-123135: langgenius dify Sandbox Run __init__.py hard-coded credentialshttps://agentprime.io/advisories/CVE-2026-123135/https://agentprime.io/advisories/CVE-2026-123135/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:45:12 GMTCVECVE-2026-105762: Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpointhttps://agentprime.io/advisories/CVE-2026-105762/https://agentprime.io/advisories/CVE-2026-105762/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 23:04:58 GMTCVECVE-2026-105761: Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servershttps://agentprime.io/advisories/CVE-2026-105761/https://agentprime.io/advisories/CVE-2026-105761/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 23:03:44 GMTCVECVE-2026-85022: langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scriptinghttps://agentprime.io/advisories/CVE-2026-85022/https://agentprime.io/advisories/CVE-2026-85022/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 03 Sep 2026 00:45:14 GMTCVECVE-2026-85021: langgenius dify Splash Layout splash.tsx router.replace cross site scriptinghttps://agentprime.io/advisories/CVE-2026-85021/https://agentprime.io/advisories/CVE-2026-85021/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 03 Sep 2026 00:30:10 GMTCVECVE-2026-18632: langgenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template enginehttps://agentprime.io/advisories/CVE-2026-18632/https://agentprime.io/advisories/CVE-2026-18632/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 03 Aug 2026 19:30:08 GMTCVECVE-2026-18266: Dify AI Workflow oauth_redirect_url Open Redirect Vulnerabilityhttps://agentprime.io/advisories/CVE-2026-18266/https://agentprime.io/advisories/CVE-2026-18266/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 29 Jul 2026 19:05:20 GMTCVECVE-2026-61461: Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_texthttps://agentprime.io/advisories/CVE-2026-61461/https://agentprime.io/advisories/CVE-2026-61461/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Jul 2026 18:10:35 GMTCVECVE-2026-41949: Dify < 1.14.2 Authorization Bypass via File Preview Endpointhttps://agentprime.io/advisories/CVE-2026-41949/https://agentprime.io/advisories/CVE-2026-41949/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 18 May 2026 13:52:03 GMTCVECVE-2026-41948: Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Accesshttps://agentprime.io/advisories/CVE-2026-41948/https://agentprime.io/advisories/CVE-2026-41948/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. CVSS score 9.3 (7.0 or more) and EPSS 0.23 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.Mon, 18 May 2026 13:50:21 GMTCVEcriticalCVE-2026-41947: Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpointshttps://agentprime.io/advisories/CVE-2026-41947/https://agentprime.io/advisories/CVE-2026-41947/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 18 May 2026 13:48:03 GMTCVEcriticalCVE-2026-41950: Dify < 1.14.0 Authorization Bypass via File UUIDhttps://agentprime.io/advisories/CVE-2026-41950/https://agentprime.io/advisories/CVE-2026-41950/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 05 May 2026 20:35:56 GMTCVECVE-2026-42138: Dify Vulnerable to Stored XSS via SVG-file uploadhttps://agentprime.io/advisories/CVE-2026-42138/https://agentprime.io/advisories/CVE-2026-42138/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 04 May 2026 17:34:36 GMTCVECVE-2026-34082: Dify has IDOR in deleting someone else's chat conversationhttps://agentprime.io/advisories/CVE-2026-34082/https://agentprime.io/advisories/CVE-2026-34082/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Apr 2026 23:03:18 GMTCVECVE-2026-6619: langgenius dify ImagePreview image-preview.tsx openInNewTab cross site scriptinghttps://agentprime.io/advisories/CVE-2026-6619/https://agentprime.io/advisories/CVE-2026-6619/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Apr 2026 08:00:17 GMTCVECVE-2026-6618: langgenius dify ApiBasedToolSchemaParser parser.py parse_openai_plugin_json_to_tool_bundle server-side request forgeryhttps://agentprime.io/advisories/CVE-2026-6618/https://agentprime.io/advisories/CVE-2026-6618/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Apr 2026 07:45:16 GMTCVECVE-2026-6617: langgenius dify ApiToolManageService api_tools_manage_service.py get_api_tool_provider_remote_schema server-side request forgeryhttps://agentprime.io/advisories/CVE-2026-6617/https://agentprime.io/advisories/CVE-2026-6617/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Apr 2026 07:30:12 GMTCVECVE-2026-21866: Dify - Stored XSS in chathttps://agentprime.io/advisories/CVE-2026-21866/https://agentprime.io/advisories/CVE-2026-21866/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Mar 2026 21:42:25 GMTCVECVE-2026-28288: Dify has a user enumeration issuehttps://agentprime.io/advisories/CVE-2026-28288/https://agentprime.io/advisories/CVE-2026-28288/CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 27 Feb 2026 20:25:24 GMTCVECVE-2026-26023: Client‑side DOM XSS in the web chat app of Dify when using echartshttps://agentprime.io/advisories/CVE-2026-26023/https://agentprime.io/advisories/CVE-2026-26023/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 11 Feb 2026 21:23:09 GMTCVECVE-2025-67732: Dify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration Endpointhttps://agentprime.io/advisories/CVE-2025-67732/https://agentprime.io/advisories/CVE-2025-67732/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Jan 2026 21:41:01 GMTCVECVE-2025-11750: User Enumeration via Distinct Error Messages in langgenius/dify-webhttps://agentprime.io/advisories/CVE-2025-11750/https://agentprime.io/advisories/CVE-2025-11750/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 22 Oct 2025 13:13:32 GMTCVECVE-2025-58747: Dify MCP OAuth Flow Vulnerable to XSShttps://agentprime.io/advisories/CVE-2025-58747/https://agentprime.io/advisories/CVE-2025-58747/CVSS 2.0 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 17 Oct 2025 15:48:04 GMTCVECVE-2025-59422: Dify Has Broken Access Control on Log Message Endpoint Allows Reading of Chats of Othershttps://agentprime.io/advisories/CVE-2025-59422/https://agentprime.io/advisories/CVE-2025-59422/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 25 Sep 2025 13:19:11 GMTCVECVE-2025-3467: XSS Vulnerability in langgenius/difyhttps://agentprime.io/advisories/CVE-2025-3467/https://agentprime.io/advisories/CVE-2025-3467/CVSS 8.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 07 Jul 2025 09:56:19 GMTCVECVE-2025-3466: Unsanitized Input in langgenius/difyhttps://agentprime.io/advisories/CVE-2025-3466/https://agentprime.io/advisories/CVE-2025-3466/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 07 Jul 2025 09:55:28 GMTCVEcriticalCVE-2025-49149: Dify has XSS vulnerabilityhttps://agentprime.io/advisories/CVE-2025-49149/https://agentprime.io/advisories/CVE-2025-49149/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 17 Jun 2025 22:34:24 GMTCVECVE-2025-43854: DIFY vulnerable to Clickjacking Attackhttps://agentprime.io/advisories/CVE-2025-43854/https://agentprime.io/advisories/CVE-2025-43854/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 28 Apr 2025 15:58:54 GMTCVECVE-2025-43862: Dify Allows Unauthorized Access and Modification of APP Orchestrationhttps://agentprime.io/advisories/CVE-2025-43862/https://agentprime.io/advisories/CVE-2025-43862/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Apr 2025 15:05:32 GMTCVECVE-2025-32796: Dify Allows Unauthorized APP Enable/Disable via APIhttps://agentprime.io/advisories/CVE-2025-32796/https://agentprime.io/advisories/CVE-2025-32796/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Apr 2025 16:06:47 GMTCVECVE-2025-32795: Dify Allows Insecure User Role Access Control for APP Editinghttps://agentprime.io/advisories/CVE-2025-32795/https://agentprime.io/advisories/CVE-2025-32795/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Apr 2025 16:05:11 GMTCVECVE-2025-32790: Dify Allows Insecure User Role Access Control for APP DSL Exportinghttps://agentprime.io/advisories/CVE-2025-32790/https://agentprime.io/advisories/CVE-2025-32790/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Apr 2025 12:15:11 GMTCVECVE-2025-0184: Server-Side Request Forgery (SSRF) in langgenius/difyhttps://agentprime.io/advisories/CVE-2025-0184/https://agentprime.io/advisories/CVE-2025-0184/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Mar 2025 10:11:38 GMTCVECVE-2024-11850: Stored XSS in langgenius/difyhttps://agentprime.io/advisories/CVE-2024-11850/https://agentprime.io/advisories/CVE-2024-11850/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Mar 2025 10:10:55 GMTCVECVE-2024-12776: Authentication Bypass in langgenius/difyhttps://agentprime.io/advisories/CVE-2024-12776/https://agentprime.io/advisories/CVE-2024-12776/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Mar 2025 10:10:42 GMTCVECVE-2024-10252: Code Injection in langgenius/difyhttps://agentprime.io/advisories/CVE-2024-10252/https://agentprime.io/advisories/CVE-2024-10252/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Mar 2025 10:10:41 GMTCVECVE-2024-12039: Improper Restriction of Excessive Authentication Attempts in langgenius/difyhttps://agentprime.io/advisories/CVE-2024-12039/https://agentprime.io/advisories/CVE-2024-12039/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Mar 2025 10:09:33 GMTCVECVE-2024-12775: SSRF in langgenius/difyhttps://agentprime.io/advisories/CVE-2024-12775/https://agentprime.io/advisories/CVE-2024-12775/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Mar 2025 10:09:23 GMTCVECVE-2024-11822: Server-Side Request Forgery (SSRF) in langgenius/difyhttps://agentprime.io/advisories/CVE-2024-11822/https://agentprime.io/advisories/CVE-2024-11822/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Mar 2025 10:09:14 GMTCVECVE-2025-0185: Pandas Query Injection in langgenius/difyhttps://agentprime.io/advisories/CVE-2025-0185/https://agentprime.io/advisories/CVE-2025-0185/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Mar 2025 10:09:11 GMTCVECVE-2024-11824: Stored XSS in langgenius/difyhttps://agentprime.io/advisories/CVE-2024-11824/https://agentprime.io/advisories/CVE-2024-11824/CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Mar 2025 10:09:08 GMTCVECVE-2024-11821: Privilege Escalation in langgenius/difyhttps://agentprime.io/advisories/CVE-2024-11821/https://agentprime.io/advisories/CVE-2024-11821/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Mar 2025 10:08:59 GMTCVECVE-2025-1796: Admin account takeover through weak Pseudo-Random number generator used in generating password reset codes in langgenius/difyhttps://agentprime.io/advisories/CVE-2025-1796/https://agentprime.io/advisories/CVE-2025-1796/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Mar 2025 10:08:46 GMTCVE