GCD AI RADAR
products/dify

Dify

Filed as: dify

Records
37
Disclosed CVEs
37
Exploited (sev 3–4)
0
CISA KEV flagged
0

Newest record 2026-10-06 · 37 distinct CVE ids · open in the explorer (the explorer matches the first product a record names, so it can list fewer)

Patch now: confirmed exploitation or KEV · 0

Records at severity 3–4 (exploitation confirmed by CISA, the vendor or reporting) and records flagged as listed in CISA KEV. The KEV flag is the classifier’s cisa-kev tag or a source on the KEV catalog; it is recorded when the collector sees the listing, so a missing flag does not mean a CVE is absent from the catalog.

No record for Dify has confirmed exploitation or a KEV flag.

Disclosures by month · last 24 months

Nov ’2437 disclosed · peak 6 in Apr ’25Oct ’26

Disclosed CVEs, no confirmed exploitation · 37

  1. 2026-10-06
    CVE-2026-105762
    CVE-2026-105762: SSRF vulnerability in Dify remote file upload endpoint
    2 Disclosedssrf
    record AIR-2026-0255NVD ↗
  2. 2026-10-05
    CVE-2026-105761
    Dify Insecure Direct Object Reference in MCP Server Endpoint
    2 Disclosedidor · dify
    record AIR-2026-0242NVD ↗
  3. 2026-09-03
    CVE-2026-85021
    CVE-2026-85021: Cross-site scripting vulnerability in Langgenius Dify splash layout
    2 Disclosedxss
    record AIR-2026-1325NVD ↗
  4. 2026-09-03
    CVE-2026-85022
    CVE-2026-85022: Cross-site scripting vulnerability in Langgenius Dify web app sign-in
    2 Disclosedxss
    record AIR-2026-1324NVD ↗
  5. 2026-08-03
    CVE-2026-18632
    CVE-2026-18632: Template injection vulnerability in langgenius Dify
    2 Disclosedtemplate-injection · dify
    record AIR-2026-1238NVD ↗
  6. 2026-07-29
    CVE-2026-18266
    CVE-2026-18266: Open redirect vulnerability in Dify AI Workflow OAuth flow
    2 Disclosedinfra_vuln
    record AIR-2026-1219NVD ↗
  7. 2026-07-10
    CVE-2026-61461
    CVE-2026-61461: Dify SQL Injection Vulnerability in MyScale Vector Store
    2 Disclosedsql-injection · vector-store
    record AIR-2026-0038NVD ↗
  8. 2026-05-18
    CVE-2026-41947
    Dify Authorization Bypass Leads to Tenant Trace Configuration Exposure
    2 Disclosedauthorization-bypass · llm-tracing
    record AIR-2026-0014NVD ↗
  9. 2026-05-18
    CVE-2026-41948
    CVE-2026-41948: Dify path traversal in Plugin Daemon REST API
    2 Discloseddify · path-traversal
    record AIR-2026-0013NVD ↗
  10. 2026-05-18
    CVE-2026-41949
    CVE-2026-41949: Dify authorization bypass in file preview endpoint
    2 Discloseddify · authorization-bypass
    record AIR-2026-0012NVD ↗
  11. 2026-05-05
    CVE-2026-41950
    CVE-2026-41950: Authorization bypass in Dify allows unauthorized file access
    2 Disclosedidor · authorization_bypass
    record AIR-2026-1066NVD ↗
  12. 2026-05-04
    CVE-2026-42138
    CVE-2026-42138: Unauthenticated XSS vulnerability in Dify
    2 Disclosedxss · file-upload
    record AIR-2026-1061NVD ↗
  13. 2026-04-20
    CVE-2026-34082
    CVE-2026-34082: Authorization flaw in Dify allows chat deletion
    2 Disclosedbroken_access_control · infra_vuln
    record AIR-2026-1043NVD ↗
  14. 2026-04-20
    CVE-2026-6619
    CVE-2026-6619: Cross-site scripting vulnerability in Langgenius Dify
    2 Disclosedxss
    record AIR-2026-1036NVD ↗
  15. 2026-04-20
    CVE-2026-6618
    CVE-2026-6618: Server-side request forgery vulnerability in langgenius dify parser
    2 Disclosedssrf · dify
    record AIR-2026-1035NVD ↗
  16. 2026-04-20
    CVE-2026-6617
    CVE-2026-6617: Server-side request forgery vulnerability in langgenius dify
    2 Disclosedssrf · dify
    record AIR-2026-1032NVD ↗
  17. 2026-03-03
    CVE-2026-21866
    CVE-2026-21866: Stored XSS vulnerability in Dify chat rendering of Mermaid diagrams
    2 Discloseddify · xss
    record AIR-2026-0979NVD ↗
  18. 2026-02-27
    CVE-2026-28288
    CVE-2026-28288: Email enumeration vulnerability in Dify LLM development platform
    2 Discloseddify · user-enumeration
    record AIR-2026-0978NVD ↗
  19. 2026-02-11
    CVE-2026-26023
    CVE-2026-26023: Cross-site scripting vulnerability in Dify LLM platform
    2 Disclosedxss
    record AIR-2026-0963NVD ↗
  20. 2026-01-05
    CVE-2025-67732
    CVE-2025-67732: API Key Exposure Vulnerability in Dify
    2 Disclosedinfra_vuln · api-key-exposure
    record AIR-2026-0002NVD ↗
  21. 2025-12-18
    CVE-2025-56157
    CVE-2025-56157: Default database credentials present in Dify configuration
    2 Discloseddefault-credentials · dify
    record AIR-2025-0044NVD ↗
  22. 2025-12-18
    CVE-2025-63386
    CVE-2025-63386: CORS misconfiguration vulnerability in Dify setup endpoint
    2 Disclosedcors · dify
    record AIR-2025-0043NVD ↗
  23. 2025-12-18
    CVE-2025-63388
    CVE-2025-63388: CORS misconfiguration in Dify console system features endpoint
    2 Discloseddify
    record AIR-2025-0042NVD ↗
  24. 2025-12-18
    CVE-2025-63387
    CVE-2025-63387: Insecure permissions in Dify system features endpoint
    2 Discloseddify
    record AIR-2025-0040NVD ↗
  25. 2025-10-17
    CVE-2025-58747
    CVE-2025-58747: Cross-site scripting vulnerability in Dify MCP OAuth component
    2 Disclosedxss
    record AIR-2025-0493NVD ↗
  26. 2025-09-30
    CVE-2025-56520
    CVE-2025-56520: Server-Side Request Forgery vulnerability in Dify v1.6.0
    2 Disclosedssrf
    record AIR-2025-0489NVD ↗
  27. 2025-09-25
    CVE-2025-59422
    CVE-2025-59422: Broken access control vulnerability in Dify exposes chat messages
    2 Disclosedbroken-access-control · dify
    record AIR-2025-0027NVD ↗
  28. 2025-07-07
    CVE-2025-3466
    CVE-2025-3466: Unsanitized input vulnerability in langgenius/dify code node
    2 Disclosedrce · dify
    record AIR-2025-0438NVD ↗
  29. 2025-06-17
    CVE-2025-49149
    CVE-2025-49149: Cross-site scripting vulnerability in Dify
    2 Disclosedxss · dify
    record AIR-2025-0429NVD ↗
  30. 2025-04-28
    CVE-2025-43854
    CVE-2025-43854: Clickjacking Vulnerability in Dify Platform
    2 Disclosedclickjacking
    record AIR-2025-0421NVD ↗
  31. 2025-04-25
    CVE-2025-43862
    CVE-2025-43862: Access Control Flaw in Dify LLM Platform
    2 Disclosedrbac
    record AIR-2025-0420NVD ↗
  32. 2025-04-18
    CVE-2025-32790
    CVE-2025-32790: Unauthorized App DSL Export Vulnerability in Dify
    2 Disclosedrbac
    record AIR-2025-0416NVD ↗
  33. 2025-04-18
    CVE-2025-32796
    CVE-2025-32796: Access Control Flaw in Dify LLM App Platform
    2 Disclosedaccess-control
    record AIR-2025-0415NVD ↗
  34. 2025-04-18
    CVE-2025-32795
    CVE-2025-32795: Authorization bypass vulnerability in Dify app management
    2 Disclosedauthorization-bypass
    record AIR-2025-0414NVD ↗
  35. 2025-04-14
    CVE-2025-29720
    CVE-2025-29720: Server-Side Request Forgery vulnerability in Dify
    2 Disclosedssrf
    record AIR-2025-0413NVD ↗
  36. 2025-03-20
    CVE-2024-10252
    CVE-2024-10252: Code injection vulnerability in Dify sandbox service
    2 Disclosedssrf · code-injection
    record AIR-2025-0410NVD ↗
  37. 2025-03-20
    CVE-2025-0185
    CVE-2025-0185: Pandas query injection vulnerability in Dify Vanna module
    2 Disclosedrce · infra_vuln
    record AIR-2025-0406NVD ↗

This page lists what has been reported, not what to do about it. Versions and fixes are in each linked advisory; check the vendor’s own advisory before acting.