Skip to content
OpenAdvisories

Vendor

langgenius

44 known vulnerabilities.

Products

dify 30 langgenius/dify 14
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Low 3.5
    CVE-2026-85022

    langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting

    A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace of the file web/app/(shareLayout)/webapp-signin/components/mail-and-password-auth.tsx of the component WebApp Sign-In. Such manipulation of…

    langgenius dify
  • Low 3.5
    CVE-2026-6619

    langgenius dify ImagePreview image-preview.tsx openInNewTab cross site scripting

    A vulnerability has been found in langgenius dify up to 1.13.3. Impacted is the function openInNewTab of the file web/app/components/base/image-uploader/image-preview.tsx of the component ImagePreview. The manipulation of the argument filename leads to cross …

    langgenius dify
  • Low 2.0
    CVE-2025-58747

    Dify MCP OAuth Flow Vulnerable to XSS

    Dify is an LLM application development platform. In Dify versions through 1.9.1, the MCP OAuth component is vulnerable to cross-site scripting when a victim connects to an attacker-controlled remote MCP server. The vulnerability exists in the OAuth flow imple…

    langgenius dify
  • Low 2.3
    CVE-2025-43854

    DIFY vulnerable to Clickjacking Attack

    DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on elements of the web page without their …

    langgenius dify