LangGenius
Security Risk Profile
40
/100
mediumSecurity Risk Score
Comprehensive risk assessment based on 32 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from March 20, 2025 to present
32
Total CVEs
13
Critical+High
0
Exploited
13
Unpatched
Threat Assessment
Avg CVSS
6.5
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
13
Critical/High
Risk Level
40/100
medium
📈 3 in Last 30 Days
Severity Distribution
Critical
3High
10Medium
17Low
2Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
5Age Distribution
Common Weaknesses (CWE)
1
XSS
6
2
SSRF
5
3
Code Injection
2
4
Weak RNG
1
Most Affected Products
1. LangGenius Dify Node.js27
2. LangGenius Dify16
3. Dify dify14
4. Dify3
5. Dify Dify AI Workflow1
Recent Vulnerabilities
See more →ZDI-26-452
CVSS 5.4medium
Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability
7/23/2026🔧 No Patch
ZDI-CAN-29196
CVSS 5.4medium
ZDI-26-452: Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability
7/23/2026🔧 No Patch
CVE-2026-18266
CVSS 5.4medium
Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability
7/23/2026🔧 No Patch
CVE-2026-41950
CVSS 6.0medium
Dify < 1.14.0 Authorization Bypass via File UUID
5/5/2026🔧 No Patch
CVE-2026-42138
CVSS 6.9medium
Dify Vulnerable to Stored XSS via SVG-file upload
5/4/2026🔧 No Patch
CVE-2025-63388
CVSS 9.1critical
12/18/2025🔧 No Patch
CVE-2025-63386
CVSS 9.1critical
12/18/2025🔧 No Patch
CVE-2025-63387
CVSS 7.5high
12/18/2025🔧 No Patch
CVE-2025-56157
CVSS 9.8critical
12/18/2025🔧 No Patch
CVE-2025-11750
CVSS 5.3medium
User Enumeration via Distinct Error Messages in langgenius/dify-web
10/22/2025🔧 No Patch
Monitor LangGenius in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.