Skip to content
OpenAdvisories

Vendor

langgenius

44 known vulnerabilities.

Products

dify 30 langgenius/dify 14
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.4
    CVE-2026-41948 Scanner template EPSS 23%

    Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access

    Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitization. Attackers can traverse out of thei…

    langgenius dify
  • Critical 9.1
    CVE-2026-41947

    Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints

    Dify before version 1.14.2 contains an authorization bypass vulnerability that allows authenticated editor users to set and enable trace configurations for any application regardless of tenant ownership. Attackers can exploit missing tenant ownership checks i…

    langgenius dify
  • Critical 9.8
    CVE-2025-3466

    Unsanitized Input in langgenius/dify

    langgenius/dify versions 1.1.0 to 1.1.2 are vulnerable to unsanitized input in the code node, allowing execution of arbitrary code with full root permissions. The vulnerability arises from the ability to override global functions in JavaScript, such as parseI…

    langgenius langgenius/dify