Skip to content
Noroxi

dify records

12 published records for vendor dify.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
0
With a fix record
41.7%
Median publish → KEV
No record has entered KEV

Records by year

  1. 25
  2. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

12 records
  • CVE-2026-41948
    38Monitor

    Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access

    CriticalCVSS 9.3Proof of conceptEPSS 2%

    dify · difyMay 18, 2026

  • CVE-2026-41947
    37Monitor

    Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints

    CriticalCVSS 9.3No exploitEPSS 1%

    dify · difyMay 18, 2026

  • CVE-2025-0185
    35Monitor

    Pandas Query Injection in langgenius/dify

    HighCVSS 8.8No exploitEPSS 1%

    dify · difyMar 20, 2025

  • CVE-2026-61461
    34Monitor

    Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text

    HighCVSS 8.7No exploitEPSS 0%

    dify · difyJul 10, 2026

  • CVE-2025-67732
    33Monitor

    Dify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration Endpoint

    HighCVSS 8.4No exploitEPSS 0%

    dify · difyJan 5, 2026

  • CVE-2026-41949
    32Monitor

    Dify < 1.14.2 Authorization Bypass via File Preview Endpoint

    HighCVSS 8.2No exploitEPSS 1%

    dify · difyMay 18, 2026

  • CVE-2024-11822
    30Monitor

    Server-Side Request Forgery (SSRF) in langgenius/dify

    HighCVSS 7.5No exploitEPSS 1%

    dify · difyMar 20, 2025

  • CVE-2026-28288
    22Monitor

    Dify has a user enumeration issue

    MediumCVSS 5.5Proof of conceptEPSS 1%

    dify · difyFeb 27, 2026

  • CVE-2025-56520
    21Monitor

    Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUplo

    MediumCVSS 5.3Proof of conceptEPSS 1%

    dify · difySep 30, 2025

  • CVE-2026-26023
    21Monitor

    Client‑side DOM XSS in the web chat app of Dify when using echarts

    MediumCVSS 5.3No exploitEPSS 0%

    dify · difyFeb 11, 2026

  • CVE-2026-34082
    21Monitor

    Dify has IDOR in deleting someone else's chat conversation

    MediumCVSS 5.3No exploitEPSS 0%

    dify · difyApr 20, 2026

  • CVE-2026-21866
    20Monitor

    Dify - Stored XSS in chat

    MediumCVSS 5.1No exploitEPSS 0%

    dify · difyMar 3, 2026