Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

13 records

Vendor: Dify Clear all filters
TI-2026-44066 CVE-2026-61461 · GHSA-hw83-q5rh-7hgf

Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text

Priority HIGH 73

Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the search_by_full_text metho…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00497 Published 2026-07-10 Fixed in 1.16.0-rc1 CWE-89
TI-2026-30345 CVE-2026-41949 · GHSA-jv3f-qwf9-wvq9

Dify < 1.14.2 Authorization Bypass via File Preview Endpoint

Priority HIGH 69

Dify before version 1.14.2 contains an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user to read up to 3,000 characters of any uploaded document across all tenants and wor…

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00435 Published 2026-05-18 Fixed in 1.14.2 CWE-639
TI-2026-30344 CVE-2026-41948 · GHSA-h666-98mq-949j

Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access

Priority HIGH 75

Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitizat…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.22707 Published 2026-05-18 No fix listed CWE-23
TI-2026-30343 CVE-2026-41947 · GHSA-48v9-p8g8-55vg

Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints

Priority HIGH 81

Dify before version 1.14.2 contains an authorization bypass vulnerability that allows authenticated editor users to set and enable trace configurations for any application regardless of tenant ownership.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.05968 Published 2026-05-18 Fixed in 1.14.2 CWE-639
TI-2026-17568 CVE-2026-21866

Dify - Stored XSS in chat

Priority MEDIUM 56

Dify is an open-source LLM app development platform.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00252 Published 2026-03-03 Fixed in 1.11.2 CWE-79
TI-2026-22595 CVE-2026-28288

Dify has a user enumeration issue

Priority MEDIUM 64

Dify is an open-source LLM app development platform.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00689 Published 2026-02-27 Fixed in 1.9.0 CWE-204
TI-2025-39292 CVE-2025-63387 · GHSA-hrf9-jmwr-6222

Improper access control in Dify

Priority MEDIUM 57

Dify 1.9.1 and 1.17.0 exposes the /console/api/system-features endpoint to unauthenticated HTTP GET requests that return system feature and configuration information.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.18712 Published 2025-12-18 No fix listed CWE-669
TI-2024-10966 CVE-2024-11822 · GHSA-8v6j-vg6w-6wwj

Server-Side Request Forgery (SSRF) in langgenius/dify

Priority HIGH 66

langgenius/dify version 0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00607 Published 2025-03-20 No fix listed CWE-918
TI-2025-00144 CVE-2025-0185 · GHSA-mf57-6hg5-mrvm

Pandas Query Injection in langgenius/dify

Priority HIGH 73

A vulnerability in the Dify Tools' Vanna module of the langgenius/dify repository allows for a Pandas Query Injection in the latest version.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.011 Published 2025-03-20 No fix listed CWE-94