L
Vendor security profile
langgenius
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs10
Critical1
CISA KEV0
Public exploit9
Patch rate%30
Avg. CVSS6.7
12-month vulnerability rate
0
2
0
0
0
0
1
0
1
1
0
2
CVE KEV
CVE severity distribution
10toplam CVE
Critical1 (10%)
High4 (40%)
Medium4 (40%)
Low1 (10%)
Patch and exploitation view
%30
Verified patch
%0
CISA KEV
%90
Public exploit
3Patch available
0Partial
0Workaround
0Vendor: no patch
7Unknown
Latest vulnerabilities
8.3
CVE-2026-105762
Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint
L
Patch status unknownEPSS %0
7.1
CVE-2026-105761
Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers
L
Patch status unknownEPSS %0
5.3
CVE-2026-18632
langgenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template engine
L
Patch status unknownEPSS %0
8.7
CVE-2026-61461
Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text
L
Patch verifiedEPSS %0
6.5
CVE-2026-41950
Vulnerability in Langgenius Dify
L
Patch status unknownEPSS %0
7.5
CVE-2025-63387
Improper access control in Langgenius Dify
L
Patch status unknownEPSS %30
9.8
CVE-2025-56157
Use of hard-coded credentials in Langgenius Dify
L
Patch status unknownEPSS %1
5.3
CVE-2025-11750
Vulnerability in Langgenius Dify
L
Patch status unknownEPSS %1
3.1
CVE-2025-59422
Improper access control in Langgenius Dify
L
Patch verifiedEPSS %0
5.4
CVE-2025-3467
Cross-site scripting in Langgenius Dify
L
Patch verifiedEPSS %0