PT-2026-65884

Dify AI Workflow oauth redirect url Open Redirect Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Dify. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a...

CVE-2026-18266: URL Redirection to Untrusted Site

Dify AI Workflow oauthredirecturl Open Redirect Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Dify. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a...

Dify v1.9.1 - Broken Access Control Detection

Dify v1.9.1 contains an insecure permissions vulnerability caused by lack of authorization checks in /console/api/system-features endpoint, letting unauthenticated attackers access sensitive system configuration data. !/usr/bin/env python3 -- coding: utf-8 -- """Dify v1.""" from kittysploit impor...

Dify Panel Detection

Detects Dify LLM application platform panels. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Dify LLM platform panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Dify Panel Detection", "description": "Detect...

Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Dify. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the OAuth flow handli...

CVE-2026-61461

Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the searchbyfulltext method without escaping or parameterization. Attackers can inject malicious SQL throu...

CVE-2026-61461 Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text

Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the searchbyfulltext method without escaping or parameterization. Attackers can inject malicious SQL throu...

CVE-2026-61461

Summary: CVE-2026-61461 affects Dify before 1.16.0-rc1, where the MyScale vector store backend is vulnerable to SQL injection via the search_by_full_text method due to unsanitized, unparameterized search parameters. This can allow an attacker to read, modify, or delete data in the underlying Clic...

CVE-2026-61461

Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the searchbyfulltext method without escaping or parameterization. Attackers can inject malicious SQL throu...

CVE-2026-61461 Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text

Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the searchbyfulltext method without escaping or parameterization. Attackers can inject malicious SQL throu...

CVE-2026-61461 Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text

Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the searchbyfulltext method without escaping or parameterization. Attackers can inject malicious SQL throu...

EUVD-2026-42973

Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the searchbyfulltext method without escaping or parameterization. Attackers can inject malicious SQL throu...

CVE-2026-61461: Improper Neutralization of Special Elements used in an SQL Command

Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the searchbyfulltext method without escaping or parameterization. Attackers can inject malicious SQL throu...

LangGenius, Inc. Dify has an SSRF vulnerability

Dify is an open-source LLM application development platform. LangGenius, Inc. Dify has an SSRF vulnerability, which allows attackers to obtain sensitive information...

LangGenius, Inc. Dify has an SSRF vulnerability (CNVD-C-2026-287908)

Dify is an open-source LLM application development platform. LangGenius, Inc. Dify has an SSRF vulnerability, which allows attackers to obtain sensitive information...

LangGenius, Inc. Dify has SSRF and arbitrary file writing vulnerabilities.

Dify is an open-source LLM application development platform. LangGenius, Inc. Dify has SSRF and arbitrary file writing vulnerabilities. Attackers can exploit these vulnerabilities to compromise the confidentiality and integrity of the system...

CVE-2026-6617

A vulnerability was detected in langgenius dify up to 0.6.9. This vulnerability affects the function getapitoolproviderremoteschema of the file api/services/tools/apitoolsmanageservice.py of the component ApiToolManageService. Performing a manipulation of the argument url results in server-side...

CVE-2026-6619

A vulnerability has been found in langgenius dify up to 1.13.3. Impacted is the function openInNewTab of the file web/app/components/base/image-uploader/image-preview.tsx of the component ImagePreview. The manipulation of the argument filename leads to cross site scripting. The attack may be...

CVE-2026-42138

Dify is an open-source LLM app development platform. Prior to version 1.13.1, using the method POST /api/files/upload, any unauthenticated user can upload an SVG file with XSS. The method POST /v1/files/upload, which requires authentication through the application API, is also vulnerable. This...

banglanlptoolkit (>=1.1.7.dev4, <=1.1.8), contextqa (>=2.0.0, <=2.0.5) +27 more potentially affected by CVE-2026-4372 via transformers (4.42.4)

transformers PYPI version 4.42.4 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - banglanlptoolkit =1.1.7.dev4, =2.0.0, =0.0.71, =0.0.1b2, =0.5.0rc0, =0.2.0, =1.0.0, =0.9.3, =0.1.0, =1.0.0, =0.1.0, =0.1.1 and more...