Dify - vulnerabilities (CVEs)
12 CVEs in 1 products, 0 in the last 30 days, newest from 2026-07-10.
Products
- Dify - 12 CVEs
Newest CVEs of Dify
- CVE-2026-61461 - CVSS 8.8 (high), 2026-07-10: Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying…
- CVE-2026-41949 - CVSS 8.2 (high), 2026-05-18: Dify before version 1.14.2 contains an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user to read up to 3,000…
- CVE-2026-41948 - CVSS 9.4 (critical), 2026-05-18: Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's…
- CVE-2026-41947 - CVSS 9.3 (critical), 2026-05-18: Dify before version 1.14.2 contains an authorization bypass vulnerability that allows authenticated editor users to set and enable trace configurations for…
- CVE-2026-34082 - CVSS 5.3 (medium), 2026-04-20: Dify is an open-source LLM app development platform. Prior to 1.13.1, the method `DELETE /console/api/installed-apps/<appId>/conversations/<conversationId>`…
- CVE-2026-21866 - CVSS 5.4 (medium), 2026-03-03: Dify is an open-source LLM app development platform. Prior to 1.11.2, Dify is vulnerable to a stored XSS issue when rendering Mermaid diagrams within chats.…
- CVE-2026-28288 - CVSS 5.5 (medium), 2026-02-27: Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an…
- CVE-2026-26023 - CVSS 6.1 (medium), 2026-02-11: Dify is an open-source LLM app development platform. Prior to 1.13.0, a cross site scripting vulnerability has been found in the web application chat frontend…
- CVE-2025-67732 - CVSS 8.4 (high), 2026-01-05: Dify is an open-source LLM app development platform. Prior to version 1.11.0, the API key is exposed in plaintext to the frontend, allowing non-administrator…
- CVE-2025-56520 - CVSS 5.3 (medium), 2025-09-30: Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi. A different…
- CVE-2025-0185 - CVSS 8.8 (high), 2025-03-20: A vulnerability in the Dify Tools' Vanna module of the langgenius/dify repository allows for a Pandas Query Injection in the latest version. The vulnerability…
- CVE-2024-11822 - CVSS 7.5 (high), 2025-03-20: langgenius/dify version 0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability. The vulnerability exists due to improper handling of the…
