Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,905All CVEsplus 19,118 rejected
- 348Last 24 hours2,786 in the last 7 days
- 16,766Last 30 days1,547 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 2 | 5 | 14 | 0 | 0 | 21 | 43 |
| 2025 | 1 | 7 | 12 | 2 | 0 | 22 | 22 |
| Title | ||
|---|---|---|
| CVE-2026-123135 | langgenius dify Sandbox Run __init__.py hard-coded credentialslanggenius · dify | Medium5.3 |
| CVE-2026-105762 | Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpointlanggenius · dify | High8.3 |
| CVE-2026-105761 | Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Serverslanggenius · dify | High7.1 |
| CVE-2026-85022 | langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scriptinglanggenius · dify | Medium5.1 |
| CVE-2026-85021 | langgenius dify Splash Layout splash.tsx router.replace cross site scriptinglanggenius · dify | Medium5.3 |
| CVE-2026-18632 | langgenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template enginelanggenius · dify | Medium5.3 |
| CVE-2026-18266 | Dify AI Workflow oauth_redirect_url Open Redirect VulnerabilityLangGenius · Dify | Medium5.4 |
| CVE-2026-61461 | Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_textlanggenius · dify | High8.7 |
| CVE-2026-41949 | Dify < 1.14.2 Authorization Bypass via File Preview Endpointlanggenius · dify | High8.2 |
| CVE-2026-41948 | Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Accesslanggenius · dify | Critical9.3 |
| CVE-2026-41947 | Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpointslanggenius · dify | Critical9.3 |
| CVE-2026-41950 | Dify < 1.14.0 Authorization Bypass via File UUIDlanggenius · dify | Medium6.0 |
| CVE-2026-42138 | Dify Vulnerable to Stored XSS via SVG-file uploadlanggenius · dify | Medium6.9 |
| CVE-2026-34082 | Dify has IDOR in deleting someone else's chat conversationlanggenius · dify | Medium5.3 |
| CVE-2026-6619 | langgenius dify ImagePreview image-preview.tsx openInNewTab cross site scriptinglanggenius · dify | Medium5.1 |
| CVE-2026-6618 | langgenius dify ApiBasedToolSchemaParser parser.py parse_openai_plugin_json_to_tool_bundle server-side request forgerylanggenius · dify | Medium5.3 |
| CVE-2026-6617 | langgenius dify ApiToolManageService api_tools_manage_service.py get_api_tool_provider_remote_schema server-side request forgerylanggenius · dify | Medium5.3 |
| CVE-2026-21866 | Dify - Stored XSS in chatlanggenius · dify | Medium5.1 |
| CVE-2026-28288 | Dify has a user enumeration issuelanggenius · dify | Medium5.5 |
| CVE-2026-26023 | Client‑side DOM XSS in the web chat app of Dify when using echartslanggenius · dify | Medium5.3 |
| CVE-2025-67732 | Dify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration Endpointlanggenius · dify | High8.4 |
| CVE-2025-11750 | User Enumeration via Distinct Error Messages in langgenius/dify-weblanggenius · langgenius/dify | Medium4.3 |
| CVE-2025-58747 | Dify MCP OAuth Flow Vulnerable to XSSlanggenius · dify | Low2.0 |
| CVE-2025-59422 | Dify Has Broken Access Control on Log Message Endpoint Allows Reading of Chats of Otherslanggenius · dify | Medium6.0 |
| CVE-2025-3467 | XSS Vulnerability in langgenius/difylanggenius · langgenius/dify | High8.0 |
| CVE-2025-3466 | Unsanitized Input in langgenius/difylanggenius · langgenius/dify | Critical9.8 |
| CVE-2025-49149 | Dify has XSS vulnerabilitylanggenius · dify | Medium5.3 |
| CVE-2025-43854 | DIFY vulnerable to Clickjacking Attacklanggenius · dify | Low2.3 |
| CVE-2025-43862 | Dify Allows Unauthorized Access and Modification of APP Orchestrationlanggenius · dify | High7.6 |
| CVE-2025-32796 | Dify Allows Unauthorized APP Enable/Disable via APIlanggenius · dify | Medium6.5 |
| CVE-2025-32795 | Dify Allows Insecure User Role Access Control for APP Editinglanggenius · dify | Medium6.5 |
| CVE-2025-32790 | Dify Allows Insecure User Role Access Control for APP DSL Exportinglanggenius · dify | Medium6.3 |
| CVE-2025-0184 | Server-Side Request Forgery (SSRF) in langgenius/difylanggenius · langgenius/dify | Medium6.5 |
| CVE-2024-11850 | Stored XSS in langgenius/difylanggenius · langgenius/dify | Medium6.8 |
| CVE-2024-12776 | Authentication Bypass in langgenius/difylanggenius · langgenius/dify | High8.1 |
| CVE-2024-10252 | Code Injection in langgenius/difylanggenius · langgenius/dify | High8.8 |
| CVE-2024-12039 | Improper Restriction of Excessive Authentication Attempts in langgenius/difylanggenius · langgenius/dify | High7.4 |
| CVE-2024-12775 | SSRF in langgenius/difylanggenius · langgenius/dify | Medium6.5 |
| CVE-2024-11822 | Server-Side Request Forgery (SSRF) in langgenius/difylanggenius · langgenius/dify | Medium6.5 |
| CVE-2025-0185 | Pandas Query Injection in langgenius/difylanggenius · langgenius/dify | High8.8 |
| CVE-2024-11824 | Stored XSS in langgenius/difylanggenius · langgenius/dify | Medium5.8 |
| CVE-2024-11821 | Privilege Escalation in langgenius/difylanggenius · langgenius/dify | Medium4.3 |
| CVE-2025-1796 | Admin account takeover through weak Pseudo-Random number generator used in generating password reset codes in langgenius/difylanggenius · langgenius/dify | High7.5 |