Priority MEDIUM 60
Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other users within the same tenant by supplying an arbitrary file U…
CVSS 4.0MEDIUM 6.0· Network · Low privileges · No interaction · EPSS 0.00346 · Published 2026-05-05 · Fixed in 1.14.0 CWE-639
Priority HIGH 70
Dify is an open-source LLM app development platform.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00235 · Published 2026-05-04 · Fixed in 1.13.1 CWE-79
Priority MEDIUM 47
A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00222 · Published 2025-12-18 · No fix listed CWE-346
Priority MEDIUM 57
Dify 1.9.1 and 1.17.0 exposes the /console/api/system-features endpoint to unauthenticated HTTP GET requests that return system feature and configuration information.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.18712 · Published 2025-12-18 · No fix listed CWE-669
Priority MEDIUM 47
A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00235 · Published 2025-12-18 · No fix listed CWE-346
Priority HIGH 82
Default credentials in Dify thru 1.5.1.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0086 · Published 2025-12-18 · No fix listed CWE-798
Priority MEDIUM 57
In langgenius/dify-web version 1.6.0, the authentication mechanism reveals the existence of user accounts by returning different error messages for non-existent and existing accounts.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.007 · Published 2025-10-22 · No fix listed CWE-544
Priority MEDIUM 44
Dify is an LLM application development platform.
CVSS 4.0LOW 2.0· Network · No auth · User interaction · EPSS 0.06014 · Published 2025-10-17 · No fix listed CWE-79
Priority MEDIUM 60
Dify is an open-source LLM app development platform.
CVSS 4.0MEDIUM 6.0· Network · Low privileges · No interaction · EPSS 0.00252 · Published 2025-09-25 · No fix listed CWE-284
Priority MEDIUM 60
An XSS vulnerability exists in langgenius/dify versions prior to 1.1.3, specifically affecting Firefox browsers.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00398 · Published 2025-07-07 · Fixed in 1.1.3 CWE-79
Priority HIGH 73
langgenius/dify versions 1.1.0 to 1.1.2 are vulnerable to unsanitized input in the code node, allowing execution of arbitrary code with full root permissions.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00825 · Published 2025-07-07 · Fixed in 1.1.3 CWE-1100
Priority MEDIUM 57
Dify is an open-source LLM app development platform.
CVSS 4.0MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.00283 · Published 2025-06-17 · No fix listed CWE-79
Priority MEDIUM 45
DIFY is an open-source LLM app development platform.
CVSS 4.0LOW 2.3· Network · No auth · User interaction · EPSS 0.00243 · Published 2025-04-28 · Fixed in 1.3.0 CWE-1021
Priority LOW 33
Dify is an open-source LLM app development platform.
CVSS 3.1HIGH 7.6· Network · Low privileges · No interaction · EPSS 0.00343 · Published 2025-04-25 · Fixed in 0.6.12 CWE-284
Priority MEDIUM 62
Dify is an open-source LLM app development platform.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00427 · Published 2025-04-18 · Fixed in 0.6.12 CWE-284
Priority MEDIUM 62
Dify is an open-source LLM app development platform.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00301 · Published 2025-04-18 · Fixed in 0.6.12 CWE-284
Priority MEDIUM 61
Dify is an open-source LLM app development platform.
CVSS 3.1MEDIUM 6.3· Network · Low privileges · No interaction · EPSS 0.0029 · Published 2025-04-18 · Fixed in 0.6.13 CWE-284
Priority MEDIUM 55
Dify v1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi.
CVSS 3.1MEDIUM 4.8· Local · Low privileges · User interaction · EPSS 0.00172 · Published 2025-04-14 · No fix listed CWE-918
Priority MEDIUM 62
A Server-Side Request Forgery (SSRF) vulnerability was identified in langgenius/dify version 0.10.2.
CVSS 3.0MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00511 · Published 2025-03-20 · Fixed in 0.11.0 CWE-918
Priority MEDIUM 58
A stored cross-site scripting (XSS) vulnerability exists in the latest version of langgenius/dify.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00442 · Published 2025-03-20 · No fix listed CWE-79
Priority HIGH 70
In langgenius/dify v0.10.1, the `/forgot-password/resets` endpoint does not verify the password reset code, allowing an attacker to reset the password of any user, including administrators.
CVSS 3.0HIGH 8.1· Network · No auth · No interaction · EPSS 0.00664 · Published 2025-03-20 · No fix listed CWE-305
Priority HIGH 67
A vulnerability in langgenius/dify versions <=v0.9.1 allows for code injection via internal SSRF requests in the Dify sandbox service.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00831 · Published 2025-03-20 · Fixed in 0.2.10 CWE-94
Priority HIGH 70
langgenius/dify version v0.10.1 contains a vulnerability where there are no limits applied to the number of code guess attempts for password reset.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00686 · Published 2025-03-20 · No fix listed CWE-307
Priority MEDIUM 62
langgenius/dify version 0.10.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the test functionality for the Create Custom Tool option via the REST API `POST /console/api/workspaces/current/tool-provider/…
CVSS 3.0MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00661 · Published 2025-03-20 · No fix listed CWE-918
Priority HIGH 66
A stored cross-site scripting (XSS) vulnerability exists in langgenius/dify version latest, specifically in the chat log functionality.
CVSS 3.1HIGH 7.6· Network · Low privileges · User interaction · EPSS 0.00479 · Published 2025-03-20 · Fixed in 0.12.1 CWE-79
Load more
THREATIST.IORead the docs