D
Vendor security profile
dify
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs11
Critical1
CISA KEV0
Public exploit10
Patch rate%27
Avg. CVSS6.7
12-month vulnerability rate
0
2
1
0
0
0
1
0
1
1
0
2
CVE KEV
CVE severity distribution
11toplam CVE
Critical1 (9%)
High4 (36%)
Medium5 (45%)
Low1 (9%)
Patch and exploitation view
%27
Verified patch
%0
CISA KEV
%91
Public exploit
3Patch available
0Partial
0Workaround
0Vendor: no patch
8Unknown
Latest vulnerabilities
7.2
CVE-2026-85679
Extendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key
E
Patch status unknownEPSS %0
9.8
CVE-2026-18143
Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler
A
Patch status unknownEPSS %0
9.8
CVE-2026-15369
Custom User Registration Fields for WooCommerce <= 2.2.3 - Unauthenticated Privilege Escalation via 'afreg_select_user_role' Parameter in Store API Checkout
A
Patch status unknownEPSS %0
8.8
CVE-2026-62857
Fedify: Server-Side Request Forgery in getNodeInfo() Allows Access to Internal Network Resources
F
Patch status unknownEPSS %0
8.7
CVE-2026-61461
Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text
L
Patch verifiedEPSS %0
6.5
CVE-2025-67732
Information exposure in Dify
D
Patch status unknownEPSS %0
7.5
CVE-2025-68475
Regular expression denial of service in Fedify
F
Patch verifiedEPSS %1