Vulnerabilidades em LangGenius

44 resultados
Análise Vexday

LangGenius apresenta presença mínima na base de vulnerabilidades com apenas 1 CVE registrado, publicado recentemente (últimos 90 dias), sem exploração ativa confirmada. A vulnerabilidade, classificada como redirecionamento aberto (CWE-601), não atinge severidade crítica, caracterizando um risco baixo e sem urgência operacional imediata.

CVE-2025-32796MEDIUMDify Allows Unauthorized APP Enable/Disable via APIEPSS 0.4%CVE-2026-105762HIGHDify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpointEPSS 0.4%CVE-2026-58141HIGHDify < 1.15.0 SSRF Protection Bypass via Remote-Files EndpointsEPSS 0.4%CVE-2025-3467HIGHXSS Vulnerability in langgenius/difyEPSS 0.4%CVE-2026-18632MEDIUMlanggenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template engineEPSS 0.4%CVE-2026-85022MEDIUMlanggenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scriptingEPSS 0.4%CVE-2025-67732HIGHDify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration EndpointEPSS 0.4%CVE-2026-41950MEDIUMDify < 1.14.0 Authorization Bypass via File UUIDEPSS 0.3%CVE-2025-43862HIGHDify Allows Unauthorized Access and Modification of APP OrchestrationEPSS 0.3%CVE-2025-32795MEDIUMDify Allows Insecure User Role Access Control for APP EditingEPSS 0.3%CVE-2026-26023MEDIUMClient‑side DOM XSS in the web chat app of Dify when using echartsEPSS 0.3%CVE-2025-32790MEDIUMDify Allows Insecure User Role Access Control for APP DSL ExportingEPSS 0.3%CVE-2026-18266MEDIUMDify AI Workflow oauth_redirect_url Open Redirect VulnerabilityEPSS 0.3%CVE-2025-49149MEDIUMDify has XSS vulnerabilityEPSS 0.3%CVE-2025-59422MEDIUMDify Has Broken Access Control on Log Message Endpoint Allows Reading of Chats of OthersEPSS 0.3%CVE-2026-21866MEDIUMDify - Stored XSS in chatEPSS 0.3%CVE-2026-105761HIGHDify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP ServersEPSS 0.2%CVE-2025-43854LOWDIFY vulnerable to Clickjacking AttackEPSS 0.2%CVE-2026-42138MEDIUMDify Vulnerable to Stored XSS via SVG-file uploadEPSS 0.2%CVE-2026-123135MEDIUMlanggenius dify Sandbox Run __init__.py hard-coded credentialsEPSS 0.2%