Priority LOW 38
Dify before 1.15.0 contains a server-side request forgery vulnerability that allows any authenticated console user to bypass SSRF protections and issue arbitrary HTTP requests to internal services and cloud metadata endp…
CVSS 4.0HIGH 7.2· Network · Low privileges · No interaction · EPSS 0.00402 · Published 2026-11-06 · Fixed in 1.15.0 CWE-918
Priority LOW 23
A vulnerability was found in langgenius dify up to 1.18.0/2.0.0-beta.2.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00214 · Published 2026-11-05 · No fix listed CWE-259
Priority HIGH 75
Dify is an open-source LLM app development platform.
CVSS 3.1HIGH 8.3· Network · No auth · No interaction · EPSS 0.00415 · Published 2026-10-05 · Fixed in 1.13.0 CWE-918
Priority LOW 31
Dify is an open-source LLM app development platform.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00246 · Published 2026-10-05 · Fixed in 1.16.0 CWE-639
Priority MEDIUM 56
A vulnerability was identified in langgenius dify 1.13.0.
CVSS 4.0MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00365 · Published 2026-09-03 · No fix listed CWE-79
Priority MEDIUM 57
A vulnerability was determined in langgenius dify 1.13.0.
CVSS 4.0MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.00497 · Published 2026-09-03 · No fix listed CWE-79
Priority MEDIUM 57
A security flaw has been discovered in langgenius dify up to 1.14.2.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00393 · Published 2026-08-03 · No fix listed CWE-1336
Priority LOW 24
Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability.
CVSS 3.0MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.00285 · Published 2026-07-29 · No fix listed CWE-601
Priority HIGH 73
Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the search_by_full_text metho…
CVSS 4.0HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.00497 · Published 2026-07-10 · Fixed in 1.16.0-rc1 CWE-89
Priority HIGH 69
Dify before version 1.14.2 contains an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user to read up to 3,000 characters of any uploaded document across all tenants and wor…
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00435 · Published 2026-05-18 · Fixed in 1.14.2 CWE-639
Priority HIGH 75
Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitizat…
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.22707 · Published 2026-05-18 · No fix listed CWE-23
Priority HIGH 81
Dify before version 1.14.2 contains an authorization bypass vulnerability that allows authenticated editor users to set and enable trace configurations for any application regardless of tenant ownership.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.05968 · Published 2026-05-18 · Fixed in 1.14.2 CWE-639
Priority MEDIUM 60
Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other users within the same tenant by supplying an arbitrary file U…
CVSS 4.0MEDIUM 6.0· Network · Low privileges · No interaction · EPSS 0.00346 · Published 2026-05-05 · Fixed in 1.14.0 CWE-639
Priority HIGH 70
Dify is an open-source LLM app development platform.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00235 · Published 2026-05-04 · Fixed in 1.13.1 CWE-79
Priority MEDIUM 63
Dify is an open-source LLM app development platform.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00188 · Published 2026-04-20 · Fixed in 1.13.1 CWE-284
Priority MEDIUM 56
A vulnerability has been found in langgenius dify up to 1.13.3.
CVSS 4.0MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00206 · Published 2026-04-20 · No fix listed CWE-79
Priority MEDIUM 57
A flaw has been found in langgenius dify up to 1.13.3.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00206 · Published 2026-04-20 · No fix listed CWE-918
Priority MEDIUM 57
A vulnerability was detected in langgenius dify up to 0.6.9.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00201 · Published 2026-04-20 · No fix listed CWE-918
Priority MEDIUM 56
Dify is an open-source LLM app development platform.
CVSS 4.0MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00252 · Published 2026-03-03 · Fixed in 1.11.2 CWE-79
Priority MEDIUM 64
Dify is an open-source LLM app development platform.
CVSS 4.0MEDIUM 5.5· Network · No auth · No interaction · EPSS 0.00689 · Published 2026-02-27 · Fixed in 1.9.0 CWE-204
Priority MEDIUM 57
Dify is an open-source LLM app development platform.
CVSS 4.0MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.00299 · Published 2026-02-11 · Fixed in 1.13.0 CWE-79
Priority LOW 36
Dify is an open-source LLM app development platform.
CVSS 4.0HIGH 8.4· Network · Low privileges · No interaction · EPSS 0.00354 · Published 2026-01-05 · Fixed in 1.11.0 CWE-200
Priority MEDIUM 47
A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00222 · Published 2025-12-18 · No fix listed CWE-346
Priority MEDIUM 57
Dify 1.9.1 and 1.17.0 exposes the /console/api/system-features endpoint to unauthenticated HTTP GET requests that return system feature and configuration information.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.18712 · Published 2025-12-18 · No fix listed CWE-669
Priority MEDIUM 47
A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00235 · Published 2025-12-18 · No fix listed CWE-346
Load more
THREATIST.IORead the docs