langgenius dify vulnerabilities

CVEs per yearBy the year they were published

1. 20258
2. 202622

Newest CVEs

• CVE-2026-58141

  Dify < 1.15.0 SSRF Protection Bypass via Remote-Files Endpoints

  langgenius · dify

  High7.2
• CVE-2026-123135

  langgenius dify Sandbox Run __init__.py hard-coded credentials

  langgenius · dify

  Medium5.3
• CVE-2026-105762

  Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint

  langgenius · dify

  High8.3
• CVE-2026-105761

  Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers

  langgenius · dify

  High7.1
• CVE-2026-85022

  langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting

  langgenius · dify

  Medium5.1
• CVE-2026-85021

  langgenius dify Splash Layout splash.tsx router.replace cross site scripting

  langgenius · dify

  Medium5.3
• CVE-2026-18632

  langgenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template engine

  langgenius · dify

  Medium5.3
• CVE-2026-18266

  Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability

  LangGenius · Dify

  Medium5.4
• CVE-2026-61461

  Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text

  langgenius · dify

  High8.7
• CVE-2026-41949

  Dify < 1.14.2 Authorization Bypass via File Preview Endpoint

  langgenius · dify

  High8.2