# cve.now: Langgenius

The newest entries naming Langgenius as an affected vendor (up to 200), of 44 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-58141](https://cve.now/CVE-2026-58141.md): Dify \< 1.15.0 SSRF Protection Bypass via Remote-Files Endpoints (CVSS 7.2)
- [CVE-2026-123135](https://cve.now/CVE-2026-123135.md): langgenius dify Sandbox Run init.py hard-coded credentials (CVSS 5.3)
- [CVE-2026-105762](https://cve.now/CVE-2026-105762.md): Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint (CVSS 8.3)
- [CVE-2026-105761](https://cve.now/CVE-2026-105761.md): Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers (CVSS 7.1)
- [CVE-2026-85022](https://cve.now/CVE-2026-85022.md): langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting (CVSS 5.1)
- [CVE-2026-85021](https://cve.now/CVE-2026-85021.md): langgenius dify Splash Layout splash.tsx router.replace cross site scripting (CVSS 5.3)
- [CVE-2026-18632](https://cve.now/CVE-2026-18632.md): langgenius dify Jinja2 jinja2\_transformer.py jinja2.Template special elements used in a template engine (CVSS 5.3)
- [CVE-2026-18266](https://cve.now/CVE-2026-18266.md): Dify AI Workflow oauth\_redirect\_url Open Redirect Vulnerability (CVSS 5.4)
- [CVE-2026-61461](https://cve.now/CVE-2026-61461.md): Dify \< 1.16.0-rc1 SQL Injection via MyScale Vector Store search\_by\_full\_text (CVSS 8.7)
- [CVE-2026-41949](https://cve.now/CVE-2026-41949.md): Dify \< 1.14.2 Authorization Bypass via File Preview Endpoint (CVSS 8.2)
- [CVE-2026-41948](https://cve.now/CVE-2026-41948.md): Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access (CVSS 9.3)
- [CVE-2026-41947](https://cve.now/CVE-2026-41947.md): Dify \< 1.14.2 Authorization Bypass via Trace Configuration Endpoints (CVSS 9.3)
- [CVE-2026-41950](https://cve.now/CVE-2026-41950.md): Dify \< 1.14.0 Authorization Bypass via File UUID (CVSS 6.0)
- [CVE-2026-42138](https://cve.now/CVE-2026-42138.md): Dify Vulnerable to Stored XSS via SVG-file upload (CVSS 6.9)
- [CVE-2026-34082](https://cve.now/CVE-2026-34082.md): Dify has IDOR in deleting someone else's chat conversation (CVSS 5.3)
- [CVE-2026-6619](https://cve.now/CVE-2026-6619.md): langgenius dify ImagePreview image-preview.tsx openInNewTab cross site scripting (CVSS 5.1)
- [CVE-2026-6618](https://cve.now/CVE-2026-6618.md): langgenius dify ApiBasedToolSchemaParser parser.py parse\_openai\_plugin\_json\_to\_tool\_bundle server-side request forgery (CVSS 5.3)
- [CVE-2026-6617](https://cve.now/CVE-2026-6617.md): langgenius dify ApiToolManageService api\_tools\_manage\_service.py get\_api\_tool\_provider\_remote\_schema server-side request forgery (CVSS 5.3)
- [CVE-2026-21866](https://cve.now/CVE-2026-21866.md): Dify - Stored XSS in chat (CVSS 5.1)
- [CVE-2026-28288](https://cve.now/CVE-2026-28288.md): Dify has a user enumeration issue (CVSS 5.5)
- [CVE-2026-26023](https://cve.now/CVE-2026-26023.md): Client‑side DOM XSS in the web chat app of Dify when using echarts (CVSS 5.3)
- [CVE-2025-67732](https://cve.now/CVE-2025-67732.md): Dify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration Endpoint (CVSS 8.4)
- [CVE-2025-11750](https://cve.now/CVE-2025-11750.md): User Enumeration via Distinct Error Messages in langgenius/dify-web (CVSS 4.3)
- [CVE-2025-58747](https://cve.now/CVE-2025-58747.md): Dify MCP OAuth Flow Vulnerable to XSS (CVSS 2.0)
- [CVE-2025-59422](https://cve.now/CVE-2025-59422.md): Dify Has Broken Access Control on Log Message Endpoint Allows Reading of Chats of Others (CVSS 6.0)
- [CVE-2025-3467](https://cve.now/CVE-2025-3467.md): XSS Vulnerability in langgenius/dify (CVSS 8.0)
- [CVE-2025-3466](https://cve.now/CVE-2025-3466.md): Unsanitized Input in langgenius/dify (CVSS 9.8)
- [CVE-2025-49149](https://cve.now/CVE-2025-49149.md): Dify has XSS vulnerability (CVSS 5.3)
- [CVE-2025-43854](https://cve.now/CVE-2025-43854.md): DIFY vulnerable to Clickjacking Attack (CVSS 2.3)
- [CVE-2025-43862](https://cve.now/CVE-2025-43862.md): Dify Allows Unauthorized Access and Modification of APP Orchestration (CVSS 7.6)
- [CVE-2025-32796](https://cve.now/CVE-2025-32796.md): Dify Allows Unauthorized APP Enable/Disable via API (CVSS 6.5)
- [CVE-2025-32795](https://cve.now/CVE-2025-32795.md): Dify Allows Insecure User Role Access Control for APP Editing (CVSS 6.5)
- [CVE-2025-32790](https://cve.now/CVE-2025-32790.md): Dify Allows Insecure User Role Access Control for APP DSL Exporting (CVSS 6.3)
- [CVE-2025-0184](https://cve.now/CVE-2025-0184.md): Server-Side Request Forgery (SSRF) in langgenius/dify (CVSS 6.5)
- [CVE-2024-11850](https://cve.now/CVE-2024-11850.md): Stored XSS in langgenius/dify (CVSS 6.8)
- [CVE-2024-12776](https://cve.now/CVE-2024-12776.md): Authentication Bypass in langgenius/dify (CVSS 8.1)
- [CVE-2024-10252](https://cve.now/CVE-2024-10252.md): Code Injection in langgenius/dify (CVSS 8.8)
- [CVE-2024-12039](https://cve.now/CVE-2024-12039.md): Improper Restriction of Excessive Authentication Attempts in langgenius/dify (CVSS 7.4)
- [CVE-2024-12775](https://cve.now/CVE-2024-12775.md): SSRF in langgenius/dify (CVSS 6.5)
- [CVE-2024-11822](https://cve.now/CVE-2024-11822.md): Server-Side Request Forgery (SSRF) in langgenius/dify (CVSS 6.5)
- [CVE-2025-0185](https://cve.now/CVE-2025-0185.md): Pandas Query Injection in langgenius/dify (CVSS 8.8)
- [CVE-2024-11824](https://cve.now/CVE-2024-11824.md): Stored XSS in langgenius/dify (CVSS 5.8)
- [CVE-2024-11821](https://cve.now/CVE-2024-11821.md): Privilege Escalation in langgenius/dify (CVSS 4.3)
- [CVE-2025-1796](https://cve.now/CVE-2025-1796.md): Admin account takeover through weak Pseudo-Random number generator used in generating password reset codes in langgenius/dify (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/langgenius
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.