CVE-2026-41950中 6.5Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files…
CVE-2026-42138中 6.1Dify is an open-source LLM app development platform. Prior to version 1.13.1, using the method POST /api/files/upload, any unauthenticated u…
CVE-2025-63387高 7.5Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/syste…
CVE-2025-56157緊急 9.8Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file included in its source co…
CVE-2025-63388緊急 9.1A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. Th…