Read the docs

langgenius

Records49All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high16CVSS 7.0–8.9

Exploited now

langgenius records in CISA KEV

No langgenius vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Dify 27 records HIGH

Records

49 records

TI-2025-35265 CVE-2025-56157 · GHSA-f5cx-j2cw-pgfg

Default credentials in Dify thru 1.5.1.

Priority HIGH 82

Default credentials in Dify thru 1.5.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0086 Published 2025-12-18 No fix listed CWE-798
TI-2026-30343 CVE-2026-41947 · GHSA-48v9-p8g8-55vg

Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints

Priority HIGH 81

Dify before version 1.14.2 contains an authorization bypass vulnerability that allows authenticated editor users to set and enable trace configurations for any application regardless of tenant ownership.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.05968 Published 2026-05-18 Fixed in 1.14.2 CWE-639
TI-2026-30344 CVE-2026-41948 · GHSA-h666-98mq-949j

Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access

Priority HIGH 75

Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitizat…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.22707 Published 2026-05-18 No fix listed CWE-23
TI-2026-44066 CVE-2026-61461 · GHSA-hw83-q5rh-7hgf

Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text

Priority HIGH 73

Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the search_by_full_text metho…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00497 Published 2026-07-10 Fixed in 1.16.0-rc1 CWE-89
TI-2025-03045 CVE-2025-3466 · GHSA-x53g-q9xm-rf4m

Unsanitized Input in langgenius/dify

Priority HIGH 73

langgenius/dify versions 1.1.0 to 1.1.2 are vulnerable to unsanitized input in the code node, allowing execution of arbitrary code with full root permissions.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00825 Published 2025-07-07 Fixed in 1.1.3 CWE-1100
TI-2025-01548 CVE-2025-1796 · GHSA-cvg9-334x-w586

Admin account takeover through weak Pseudo-Random number generator used in generating…

Priority HIGH 73

A vulnerability in langgenius/dify v0.10.1 allows an attacker to take over any account, including administrator accounts, by exploiting a weak pseudo-random number generator (PRNG) used for generating password reset code…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00606 Published 2025-03-20 No fix listed CWE-338
TI-2025-00144 CVE-2025-0185 · GHSA-mf57-6hg5-mrvm

Pandas Query Injection in langgenius/dify

Priority HIGH 73

A vulnerability in the Dify Tools' Vanna module of the langgenius/dify repository allows for a Pandas Query Injection in the latest version.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.011 Published 2025-03-20 No fix listed CWE-94
TI-2024-11840 CVE-2024-12776 · GHSA-g394-qpx6-x7rr

Authentication Bypass in langgenius/dify

Priority HIGH 70

In langgenius/dify v0.10.1, the `/forgot-password/resets` endpoint does not verify the password reset code, allowing an attacker to reset the password of any user, including administrators.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.00664 Published 2025-03-20 No fix listed CWE-305
TI-2026-30345 CVE-2026-41949 · GHSA-jv3f-qwf9-wvq9

Dify < 1.14.2 Authorization Bypass via File Preview Endpoint

Priority HIGH 69

Dify before version 1.14.2 contains an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user to read up to 3,000 characters of any uploaded document across all tenants and wor…

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00435 Published 2026-05-18 Fixed in 1.14.2 CWE-639
TI-2024-09502 CVE-2024-10252 · GHSA-gvmg-6fvg-2jp2

Code Injection in langgenius/dify

Priority HIGH 67

A vulnerability in langgenius/dify versions <=v0.9.1 allows for code injection via internal SSRF requests in the Dify sandbox service.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00831 Published 2025-03-20 Fixed in 0.2.10 CWE-94
TI-2024-10968 CVE-2024-11824 · GHSA-64c5-jj57-f29g

Stored XSS in langgenius/dify

Priority HIGH 66

A stored cross-site scripting (XSS) vulnerability exists in langgenius/dify version latest, specifically in the chat log functionality.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00479 Published 2025-03-20 Fixed in 0.12.1 CWE-79
TI-2024-10966 CVE-2024-11822 · GHSA-8v6j-vg6w-6wwj

Server-Side Request Forgery (SSRF) in langgenius/dify

Priority HIGH 66

langgenius/dify version 0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00607 Published 2025-03-20 No fix listed CWE-918
TI-2026-22595 CVE-2026-28288

Dify has a user enumeration issue

Priority MEDIUM 64

Dify is an open-source LLM app development platform.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00689 Published 2026-02-27 Fixed in 1.9.0 CWE-204
TI-2025-00143 CVE-2025-0184 · GHSA-823j-2wj6-7jwh

Server-Side Request Forgery (SSRF) in langgenius/dify

Priority MEDIUM 62

A Server-Side Request Forgery (SSRF) vulnerability was identified in langgenius/dify version 0.10.2.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00511 Published 2025-03-20 Fixed in 0.11.0 CWE-918
TI-2024-11839 CVE-2024-12775 · GHSA-p926-8677-385w

SSRF in langgenius/dify

Priority MEDIUM 62

langgenius/dify version 0.10.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the test functionality for the Create Custom Tool option via the REST API `POST /console/api/workspaces/current/tool-provider/…

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00661 Published 2025-03-20 No fix listed CWE-918
TI-2026-30346 CVE-2026-41950 · GHSA-r2m5-9rwx-269r

Dify < 1.14.0 Authorization Bypass via File UUID

Priority MEDIUM 60

Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other users within the same tenant by supplying an arbitrary file U…

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00346 Published 2026-05-05 Fixed in 1.14.0 CWE-639
TI-2025-03046 CVE-2025-3467 · GHSA-hpxx-hcf6-3cvj

XSS Vulnerability in langgenius/dify

Priority MEDIUM 60

An XSS vulnerability exists in langgenius/dify versions prior to 1.1.3, specifically affecting Firefox browsers.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00398 Published 2025-07-07 Fixed in 1.1.3 CWE-79
Load more
Open these records in search →