Langgenius Dify
39 CVEs affecting Langgenius Dify. Latest disclosed: 2026-07-10. Critical: 5, High: 9.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-56157 | Critical | 9.8 | 2025-12-18 | Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file included in its source code. NOTE: the Suppl… |
CVE-2026-41948 | Critical | 9.4 | 2026-05-18 | Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's in… |
CVE-2026-41947 | Critical | 9.1 | 2026-05-18 | Dify before version 1.14.2 contains an authorization bypass vulnerability that allows authenticated editor users to set and enable trace configurations for any… |
CVE-2025-63388 | Critical | 9.1 | 2025-12-18 | A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. The endpoint implemen… |
CVE-2025-63386 | Critical | 9.1 | 2025-12-18 | A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpoint implements an inse… |
CVE-2026-61461 | High | 8.8 | 2026-07-10 | Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying u… |
CVE-2025-1796 | High | 8.8 | 2025-03-20 | A vulnerability in langgenius/dify v0.10.1 allows an attacker to take over any account, including administrator accounts, by exploiting a weak pseudo-random nu… |
CVE-2024-12776 | High | 8.1 | 2025-03-20 | In langgenius/dify v0.10.1, the `/forgot-password/resets` endpoint does not verify the password reset code, allowing an attacker to reset the password of any u… |
CVE-2024-12039 | High | 8.1 | 2025-03-20 | langgenius/dify version v0.10.1 contains a vulnerability where there are no limits applied to the number of code guess attempts for password reset. This allows… |
CVE-2025-43862 | High | 7.6 | 2025-04-25 | Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web… |
CVE-2024-11824 | High | 7.6 | 2025-03-20 | A stored cross-site scripting (XSS) vulnerability exists in langgenius/dify version latest, specifically in the chat log functionality. The vulnerability arise… |
CVE-2025-63387 | High | 7.5 | 2025-12-18 | Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint… |
CVE-2025-3466 | High | 7.2 | 2025-07-07 | langgenius/dify versions 1.1.0 to 1.1.2 are vulnerable to unsanitized input in the code node, allowing execution of arbitrary code with full root permissions… |
CVE-2024-10252 | High | 7.2 | 2025-03-20 | A vulnerability in langgenius/dify versions <=v0.9.1 allows for code injection via internal SSRF requests in the Dify sandbox service. This vulnerability enabl… |
CVE-2026-41950 | Medium | 6.5 | 2026-05-05 | Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other… |
CVE-2025-67732 | Medium | 6.5 | 2026-01-05 | Dify is an open-source LLM app development platform. Prior to version 1.11.0, the API key is exposed in plaintext to the frontend, allowing non-administrator u… |
CVE-2025-32796 | Medium | 6.5 | 2025-04-18 | Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users can enable or disab… |
CVE-2025-32795 | Medium | 6.5 | 2025-04-18 | Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users are improperly gran… |
CVE-2025-0184 | Medium | 6.5 | 2025-03-20 | A Server-Side Request Forgery (SSRF) vulnerability was identified in langgenius/dify version 0.10.2. The vulnerability occurs in the 'Create Knowledge' section… |
CVE-2024-12775 | Medium | 6.5 | 2025-03-20 | langgenius/dify version 0.10.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the test functionality for the Create Custom Tool option via the… |