Skip to content
OpenAdvisories

Product · langgenius

dify

30 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.4
    CVE-2026-41948 Scanner template EPSS 23%

    Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access

    Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitization. Attackers can traverse out of thei…

    langgenius dify
  • Critical 9.1
    CVE-2026-41947

    Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints

    Dify before version 1.14.2 contains an authorization bypass vulnerability that allows authenticated editor users to set and enable trace configurations for any application regardless of tenant ownership. Attackers can exploit missing tenant ownership checks i…

    langgenius dify