Where
-Infinity
0

Trending

Last week
Last month
Last year

Dify difyDify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text

Risk 79
Severity
8.7
First published (updated )
CVE-2026-61461

Dify difyDify < 1.14.2 Authorization Bypass via File Preview Endpoint

Risk 45
Severity
8.2
First published (updated )
CVE-2026-41949

Dify difyDify v1.14.1 Path Traversal via Plugin Daemon Internal API Access

Risk 79
Severity
9.3
First published (updated )
CVE-2026-41948

Dify difyDify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints

Risk 70
Severity
9.3
First published (updated )
CVE-2026-41947

Dify difyDify < 1.14.0 Authorization Bypass via File UUID

Risk 40
Severity
6
First published (updated )
CVE-2026-41950
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Dify difyDify Vulnerable to Stored XSS via SVG-file upload

Risk 33
Severity
6.9
First published (updated )
CVE-2026-42138

Dify difyDify has IDOR in deleting someone else's chat conversation

Risk 26
Severity
5.3
First published (updated )
CVE-2026-34082

Dify difyDify - Stored XSS in chat

Risk 34
Severity
5.4
First published (updated )
CVE-2026-21866

Dify difyDify has a user enumeration issue

Risk 20
Severity
5.5
EPSS
0.03%
First published (updated )
CVE-2026-28288

Dify difyClient‑side DOM XSS in the web chat app of Dify when using echarts

Risk 27
Severity
6.1
EPSS
0.03%
First published (updated )
CVE-2026-26023
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

DifyDify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration Endpoint

Risk 65
Severity
8.4
First published (updated )
CVE-2025-67732

Dify difyA Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /…

Risk 66
Severity
9.1
First published (updated )
CVE-2025-63388

Dify difyDify MCP OAuth Flow Vulnerable to XSS

Risk 38
Severity
2
First published (updated )
CVE-2025-58747

Dify difyDify Has Broken Access Control on Log Message Endpoint Allows Reading of Chats of Others

Risk 35
Severity
6
First published (updated )
CVE-2025-59422

Dify difyDify has XSS vulnerability

Risk 38
Severity
5.3
First published (updated )
CVE-2025-49149
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Dify difyDIFY vulnerable to Clickjacking Attack

Risk 27
Severity
2.3
EPSS
0.03%
First published (updated )
CVE-2025-43854

Dify difyDify Allows Unauthorized Access and Modification of APP Orchestration

Risk 42
Severity
7.6
EPSS
0.04%
First published (updated )
CVE-2025-43862

Dify difyDify Allows Unauthorized APP Enable/Disable via API

Risk 27
Severity
6.5
EPSS
0.03%
First published (updated )
CVE-2025-32796

Dify difyDify Allows Insecure User Role Access Control for APP Editing

Risk 27
Severity
6.5
EPSS
0.02%
First published (updated )
CVE-2025-32795

Dify difyDify Allows Insecure User Role Access Control for APP DSL Exporting

Risk 33
Severity
6.3
EPSS
0.03%
First published (updated )
CVE-2025-32790
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Dify difySSRF

Risk 35
Severity
4.8
First published (updated )
CVE-2025-29720

LangGenius DifyServer-Side Request Forgery (SSRF) in langgenius/dify

Risk 43
Severity
7.5
First published (updated )
CVE-2024-11822

Dify difyPandas Query Injection in langgenius/dify

Risk 79
Severity
8.8
First published (updated )
CVE-2025-0185

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203