Skip to content
OpenAdvisories

Vendor

langgenius

44 known vulnerabilities.

Products

dify 30 langgenius/dify 14
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.1
    CVE-2026-105761 Public exploit

    Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers

    Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/<app_id>/server endpoint in api/controllers/console/app/mcp_server.py used AppMCPServerController.put() to retrieve an AppMCPServer by the client-supplied se…

    langgenius dify
  • Medium 6.5
    CVE-2025-0184 Public exploit

    Server-Side Request Forgery (SSRF) in langgenius/dify

    A Server-Side Request Forgery (SSRF) vulnerability was identified in langgenius/dify version 0.10.2. The vulnerability occurs in the 'Create Knowledge' section when uploading DOCX files. If an external relationship exists in the DOCX file, the reltype value i…

    langgenius langgenius/dify