dify

Records15

1. closed7.1
   Dify Dify Insecure Direct Object Reference in MCP Server Endpoint

   Patch now · Disclosed · since 5 Oct 2026 · CVE-2026-105761

   AI
2. closed6.3
   Dify CVE-2026-18632: Template injection vulnerability in langgenius Dify

   Patch now · Disclosed · since 3 Aug 2026 · CVE-2026-18632

   AI
3. closed9.2
   Dify CVE-2026-41948: Dify path traversal in Plugin Daemon REST API

   Patch now · Disclosed · since 18 May 2026 · CVE-2026-41948

   AI
4. closed8.2
   Dify CVE-2026-41949: Dify authorization bypass in file preview endpoint

   Patch now · Disclosed · since 18 May 2026 · CVE-2026-41949

   AI
5. closed6.3
   Dify CVE-2026-6618: Server-side request forgery vulnerability in langgenius dify parser

   Patch now · Disclosed · since 20 Apr 2026 · CVE-2026-6618

   AI
6. closed6.3
   Dify CVE-2026-6617: Server-side request forgery vulnerability in langgenius dify

   Patch now · Disclosed · since 20 Apr 2026 · CVE-2026-6617

   AI
7. closed5.4
   Dify CVE-2026-21866: Stored XSS vulnerability in Dify chat rendering of Mermaid diagrams

   Patch now · Disclosed · since 3 Mar 2026 · CVE-2026-21866

   AI
8. closed5.5
   Dify CVE-2026-28288: Email enumeration vulnerability in Dify LLM development platform

   Patch now · Disclosed · since 27 Feb 2026 · CVE-2026-28288

   AI
9. closed9.8
   Dify CVE-2025-56157: Default database credentials present in Dify configuration

   Patch now · Disclosed · since 18 Dec 2025 · CVE-2025-56157

   AI
10. closed9.1
    Dify CVE-2025-63386: CORS misconfiguration vulnerability in Dify setup endpoint

    Patch now · Disclosed · since 18 Dec 2025 · CVE-2025-63386

    AI
11. closed9.1
    Dify CVE-2025-63388: CORS misconfiguration in Dify console system features endpoint

    Patch now · Disclosed · since 18 Dec 2025 · CVE-2025-63388

    AI
12. closed7.5
    Dify CVE-2025-63387: Insecure permissions in Dify system features endpoint

    Patch now · Disclosed · since 18 Dec 2025 · CVE-2025-63387

    AI
13. closed6.0
    Dify CVE-2025-59422: Broken access control vulnerability in Dify exposes chat messages

    Patch now · Disclosed · since 25 Sep 2025 · CVE-2025-59422

    AI
14. closed9.8
    Dify CVE-2025-3466: Unsanitized input vulnerability in langgenius/dify code node

    Patch now · Disclosed · since 7 Jul 2025 · CVE-2025-3466

    AI
15. closed6.1
    Dify CVE-2025-49149: Cross-site scripting vulnerability in Dify

    Patch now · Disclosed · since 17 Jun 2025 · CVE-2025-49149

    AI