Langgenius vulnerabilities
44 CVEs and advisories name Langgenius as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-58141Dify < 1.15.0 SSRF Protection Bypass via Remote-Files Endpoints
- CVE-2026-123135langgenius dify Sandbox Run init.py hard-coded credentials
- CVE-2026-105762Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint
- CVE-2026-105761Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers
- CVE-2026-85022langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting
- CVE-2026-85021langgenius dify Splash Layout splash.tsx router.replace cross site scripting
- CVE-2026-18632langgenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template engine
- CVE-2026-18266Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability
- CVE-2026-61461Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text
- CVE-2026-41949Dify < 1.14.2 Authorization Bypass via File Preview Endpoint
- CVE-2026-41948Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access
- CVE-2026-41947Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints
- CVE-2026-41950Dify < 1.14.0 Authorization Bypass via File UUID
- CVE-2026-42138Dify Vulnerable to Stored XSS via SVG-file upload
- CVE-2026-34082Dify has IDOR in deleting someone else's chat conversation
- CVE-2026-6619langgenius dify ImagePreview image-preview.tsx openInNewTab cross site scripting
- CVE-2026-6618langgenius dify ApiBasedToolSchemaParser parser.py parse_openai_plugin_json_to_tool_bundle server-side request forgery
- CVE-2026-6617langgenius dify ApiToolManageService api_tools_manage_service.py get_api_tool_provider_remote_schema server-side request forgery
- CVE-2026-21866Dify - Stored XSS in chat
- CVE-2026-28288Dify has a user enumeration issue
- CVE-2026-26023Client‑side DOM XSS in the web chat app of Dify when using echarts
- CVE-2025-67732Dify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration Endpoint
- CVE-2025-11750User Enumeration via Distinct Error Messages in langgenius/dify-web
- CVE-2025-58747Dify MCP OAuth Flow Vulnerable to XSS
- CVE-2025-59422Dify Has Broken Access Control on Log Message Endpoint Allows Reading of Chats of Others
- CVE-2025-3467XSS Vulnerability in langgenius/dify
- CVE-2025-3466Unsanitized Input in langgenius/dify
- CVE-2025-49149Dify has XSS vulnerability
- CVE-2025-43854DIFY vulnerable to Clickjacking Attack
- CVE-2025-43862Dify Allows Unauthorized Access and Modification of APP Orchestration