dify kayıtları
dify üreticisine ait 12 yayımlanmış kayıt.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 0 · %0
- Pre-auth RCE
- 0
- Düzeltme kaydı olan
- %41,7
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Tekrar eden sınıflar
- CWE-639 Authorization Bypass Through User-Controlled Key2
- CWE-918 Server-Side Request Forgery (SSRF)2
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')2
- CWE-284 Improper Access Control1
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')1
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor1
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWETüm kayıtlar
12 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
38İzleyin | CVE-2026-41948Kavram kanıtı | Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Accessdify · dify · CWE-23 | Kritik9,3 | — | %1,9 | 18 May 2026 |
37İzleyin | CVE-2026-41947İstismar yok | Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpointsdify · dify · CWE-639 | Kritik9,3 | — | %0,6 | 18 May 2026 |
35İzleyin | CVE-2025-0185İstismar yok | Pandas Query Injection in langgenius/difydify · dify · CWE-94 | Yüksek8,8 | — | %1,1 | 20 Mar 2025 |
34İzleyin | CVE-2026-61461İstismar yok | Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_textdify · dify · CWE-89 | Yüksek8,7 | — | %0,5 | 10 Tem 2026 |
33İzleyin | CVE-2025-67732İstismar yok | Dify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration Endpointdify · dify · CWE-200 | Yüksek8,4 | — | %0,3 | 5 Oca 2026 |
32İzleyin | CVE-2026-41949İstismar yok | Dify < 1.14.2 Authorization Bypass via File Preview Endpointdify · dify · CWE-639 | Yüksek8,2 | — | %0,6 | 18 May 2026 |
30İzleyin | CVE-2024-11822İstismar yok | Server-Side Request Forgery (SSRF) in langgenius/difydify · dify · CWE-918 | Yüksek7,5 | — | %0,6 | 20 Mar 2025 |
22İzleyin | CVE-2026-28288Kavram kanıtı | Dify has a user enumeration issuedify · dify · CWE-204 | Orta5,5 | — | %0,7 | 27 Şub 2026 |
21İzleyin | CVE-2025-56520Kavram kanıtı | Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUplodify · dify · CWE-918 | Orta5,3 | — | %0,7 | 30 Eyl 2025 |
21İzleyin | CVE-2026-26023İstismar yok | Client‑side DOM XSS in the web chat app of Dify when using echartsdify · dify · CWE-79 | Orta5,3 | — | %0,4 | 11 Şub 2026 |
21İzleyin | CVE-2026-34082İstismar yok | Dify has IDOR in deleting someone else's chat conversationdify · dify · CWE-284 | Orta5,3 | — | %0,3 | 20 Nis 2026 |
20İzleyin | CVE-2026-21866İstismar yok | Dify - Stored XSS in chatdify · dify · CWE-79 | Orta5,1 | — | %0,2 | 3 Mar 2026 |
- CVE-2026-4194838İzleyin
Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access
KritikCVSS 9,3Kavram kanıtıEPSS %2dify · dify18 May 2026
- CVE-2026-4194737İzleyin
Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints
KritikCVSS 9,3İstismar yokEPSS %1dify · dify18 May 2026
- CVE-2025-018535İzleyin
Pandas Query Injection in langgenius/dify
YüksekCVSS 8,8İstismar yokEPSS %1dify · dify20 Mar 2025
- CVE-2026-6146134İzleyin
Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text
YüksekCVSS 8,7İstismar yokEPSS %0dify · dify10 Tem 2026
- CVE-2025-6773233İzleyin
Dify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration Endpoint
YüksekCVSS 8,4İstismar yokEPSS %0dify · dify5 Oca 2026
- CVE-2026-4194932İzleyin
Dify < 1.14.2 Authorization Bypass via File Preview Endpoint
YüksekCVSS 8,2İstismar yokEPSS %1dify · dify18 May 2026
- CVE-2024-1182230İzleyin
Server-Side Request Forgery (SSRF) in langgenius/dify
YüksekCVSS 7,5İstismar yokEPSS %1dify · dify20 Mar 2025
- CVE-2026-2828822İzleyin
Dify has a user enumeration issue
OrtaCVSS 5,5Kavram kanıtıEPSS %1dify · dify27 Şub 2026
- CVE-2025-5652021İzleyin
Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUplo
OrtaCVSS 5,3Kavram kanıtıEPSS %1dify · dify30 Eyl 2025
- CVE-2026-2602321İzleyin
Client‑side DOM XSS in the web chat app of Dify when using echarts
OrtaCVSS 5,3İstismar yokEPSS %0dify · dify11 Şub 2026
- CVE-2026-3408221İzleyin
Dify has IDOR in deleting someone else's chat conversation
OrtaCVSS 5,3İstismar yokEPSS %0dify · dify20 Nis 2026
- CVE-2026-2186620İzleyin
Dify - Stored XSS in chat
OrtaCVSS 5,1İstismar yokEPSS %0dify · dify3 Mar 2026