Read the docs

langgenius

Records49All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high16CVSS 7.0–8.9

Exploited now

langgenius records in CISA KEV

No langgenius vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Dify 27 records HIGH

Records

27 records in Dify · all components

TI-2025-35265 CVE-2025-56157 · GHSA-f5cx-j2cw-pgfg

Default credentials in Dify thru 1.5.1.

Priority HIGH 82

Default credentials in Dify thru 1.5.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0086 Published 2025-12-18 No fix listed CWE-798
TI-2025-03045 CVE-2025-3466 · GHSA-x53g-q9xm-rf4m

Unsanitized Input in langgenius/dify

Priority HIGH 73

langgenius/dify versions 1.1.0 to 1.1.2 are vulnerable to unsanitized input in the code node, allowing execution of arbitrary code with full root permissions.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00825 Published 2025-07-07 Fixed in 1.1.3 CWE-1100
TI-2025-01548 CVE-2025-1796 · GHSA-cvg9-334x-w586

Admin account takeover through weak Pseudo-Random number generator used in generating…

Priority HIGH 73

A vulnerability in langgenius/dify v0.10.1 allows an attacker to take over any account, including administrator accounts, by exploiting a weak pseudo-random number generator (PRNG) used for generating password reset code…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00606 Published 2025-03-20 No fix listed CWE-338
TI-2024-11840 CVE-2024-12776 · GHSA-g394-qpx6-x7rr

Authentication Bypass in langgenius/dify

Priority HIGH 70

In langgenius/dify v0.10.1, the `/forgot-password/resets` endpoint does not verify the password reset code, allowing an attacker to reset the password of any user, including administrators.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.00664 Published 2025-03-20 No fix listed CWE-305
TI-2024-09502 CVE-2024-10252 · GHSA-gvmg-6fvg-2jp2

Code Injection in langgenius/dify

Priority HIGH 67

A vulnerability in langgenius/dify versions <=v0.9.1 allows for code injection via internal SSRF requests in the Dify sandbox service.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00831 Published 2025-03-20 Fixed in 0.2.10 CWE-94
TI-2024-10968 CVE-2024-11824 · GHSA-64c5-jj57-f29g

Stored XSS in langgenius/dify

Priority HIGH 66

A stored cross-site scripting (XSS) vulnerability exists in langgenius/dify version latest, specifically in the chat log functionality.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00479 Published 2025-03-20 Fixed in 0.12.1 CWE-79
TI-2025-00143 CVE-2025-0184 · GHSA-823j-2wj6-7jwh

Server-Side Request Forgery (SSRF) in langgenius/dify

Priority MEDIUM 62

A Server-Side Request Forgery (SSRF) vulnerability was identified in langgenius/dify version 0.10.2.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00511 Published 2025-03-20 Fixed in 0.11.0 CWE-918
TI-2024-11839 CVE-2024-12775 · GHSA-p926-8677-385w

SSRF in langgenius/dify

Priority MEDIUM 62

langgenius/dify version 0.10.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the test functionality for the Create Custom Tool option via the REST API `POST /console/api/workspaces/current/tool-provider/…

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00661 Published 2025-03-20 No fix listed CWE-918
TI-2026-30346 CVE-2026-41950 · GHSA-r2m5-9rwx-269r

Dify < 1.14.0 Authorization Bypass via File UUID

Priority MEDIUM 60

Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other users within the same tenant by supplying an arbitrary file U…

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00346 Published 2026-05-05 Fixed in 1.14.0 CWE-639
TI-2025-03046 CVE-2025-3467 · GHSA-hpxx-hcf6-3cvj

XSS Vulnerability in langgenius/dify

Priority MEDIUM 60

An XSS vulnerability exists in langgenius/dify versions prior to 1.1.3, specifically affecting Firefox browsers.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00398 Published 2025-07-07 Fixed in 1.1.3 CWE-79
TI-2024-10993 CVE-2024-11850 · GHSA-7j9v-mc62-mcm5

Stored XSS in langgenius/dify

Priority MEDIUM 58

A stored cross-site scripting (XSS) vulnerability exists in the latest version of langgenius/dify.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00442 Published 2025-03-20 No fix listed CWE-79
TI-2025-39292 CVE-2025-63387 · GHSA-hrf9-jmwr-6222

Improper access control in Dify

Priority MEDIUM 57

Dify 1.9.1 and 1.17.0 exposes the /console/api/system-features endpoint to unauthenticated HTTP GET requests that return system feature and configuration information.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.18712 Published 2025-12-18 No fix listed CWE-669
TI-2025-31229 CVE-2025-49149

Dify has XSS vulnerability

Priority MEDIUM 57

Dify is an open-source LLM app development platform.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00283 Published 2025-06-17 No fix listed CWE-79
TI-2025-10773 CVE-2025-11750 · GHSA-f95f-xqrr-qc3c

User Enumeration via Distinct Error Messages in langgenius/dify-web

Priority MEDIUM 57

In langgenius/dify-web version 1.6.0, the authentication mechanism reveals the existence of user accounts by returning different error messages for non-existent and existing accounts.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.007 Published 2025-10-22 No fix listed CWE-544
TI-2024-10965 CVE-2024-11821 · GHSA-97pg-wr4r-53wr

Privilege Escalation in langgenius/dify

Priority MEDIUM 53

A privilege escalation vulnerability exists in langgenius/dify version 0.9.1.

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0049 Published 2025-03-20 No fix listed CWE-250
TI-2025-28438 CVE-2025-43854

DIFY vulnerable to Clickjacking Attack

Priority MEDIUM 45

DIFY is an open-source LLM app development platform.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00243 Published 2025-04-28 Fixed in 1.3.0 CWE-1021
Load more
Open these records in search →