Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

langgenius Security Vulnerabilities | CyStack CVE Database

Vulnerability	Exploitation status	Fix	Affected product	Published	Severity

`CVE-2026-85022`langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting	Exploitation statusPublic exploit	FixNot confirmed	Affected productdify	Published09/03/2026	SeverityMedium
`CVE-2026-85021`langgenius dify Splash Layout splash.tsx router.replace cross site scripting	Exploitation statusPublic exploit	FixNot confirmed	Affected productdify	Published09/03/2026	SeverityMedium
`CVE-2026-18632`langgenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template engine	Exploitation statusPublic exploit	FixNot confirmed	Affected productdify	Published08/03/2026	SeverityMedium
`CVE-2026-18266`Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability	Exploitation statusNot known exploited	FixNot confirmed	Affected productdify	Published07/29/2026	SeverityMedium
`CVE-2026-61461`Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text	Exploitation statusPublic exploit	FixYes	Affected productdify	Published07/10/2026	SeverityHigh
`CVE-2026-41949`Dify < 1.14.2 Authorization Bypass via File Preview Endpoint	Exploitation statusPublic exploit	FixYes	Affected productdify	Published05/18/2026	SeverityHigh
`CVE-2026-41948`Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access	Exploitation statusPublic exploit	FixNot confirmed	Affected productdify	Published05/18/2026	SeverityCritical
`CVE-2026-41947`Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints	Exploitation statusPublic exploit	FixYes	Affected productdify	Published05/18/2026	SeverityCritical
`CVE-2026-41950`Dify < 1.14.0 Authorization Bypass via File UUID	Exploitation statusPublic exploit	FixYes	Affected productdify	Published05/05/2026	SeverityMedium
`CVE-2026-42138`Dify Vulnerable to Stored XSS via SVG-file upload	Exploitation statusPublic exploit	FixYes	Affected productdify	Published05/04/2026	SeverityMedium
`CVE-2026-34082`Dify has IDOR in deleting someone else's chat conversation	Exploitation statusPublic exploit	FixNot confirmed	Affected productdify	Published04/20/2026	SeverityMedium
`CVE-2026-6619`langgenius dify ImagePreview image-preview.tsx openInNewTab cross site scripting	Exploitation statusPublic exploit	FixNot confirmed	Affected productdify	Published04/20/2026	SeverityMedium
`CVE-2026-6618`langgenius dify ApiBasedToolSchemaParser parser.py parse_openai_plugin_json_to_tool_bundle server-side request forgery	Exploitation statusPublic exploit	FixNot confirmed	Affected productdify	Published04/20/2026	SeverityMedium
`CVE-2026-6617`langgenius dify ApiToolManageService api_tools_manage_service.py get_api_tool_provider_remote_schema server-side request forgery	Exploitation statusPublic exploit	FixNot confirmed	Affected productdify	Published04/20/2026	SeverityMedium
`CVE-2026-21866`Dify - Stored XSS in chat	Exploitation statusPublic exploit	FixYes	Affected productdify	Published03/03/2026	SeverityMedium
`CVE-2026-28288`Dify has a user enumeration issue	Exploitation statusPublic exploit	FixNot confirmed	Affected productdify	Published02/27/2026	SeverityMedium
`CVE-2026-26023`Client‑side DOM XSS in the web chat app of Dify when using echarts	Exploitation statusPublic exploit	FixYes	Affected productdify	Published02/11/2026	SeverityMedium
`CVE-2025-67732`Dify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration Endpoint	Exploitation statusNot known exploited	FixNot confirmed	Affected productdify	Published01/05/2026	SeverityHigh
`CVE-2025-63388`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published12/18/2025	SeverityCritical
`CVE-2025-56157`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published12/18/2025	SeverityCritical
`CVE-2025-63387`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published12/18/2025	SeverityHigh
`CVE-2025-63386`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published12/18/2025	SeverityCritical
`CVE-2025-11750`User Enumeration via Distinct Error Messages in langgenius/dify-web	Exploitation statusPublic exploit	FixNot confirmed	Affected productlanggenius/dify	Published10/22/2025	SeverityMedium
`CVE-2025-58747`Dify MCP OAuth Flow Vulnerable to XSS	Exploitation statusPublic exploit	FixNot confirmed	Affected productdify	Published10/17/2025	SeverityLow
`CVE-2025-59422`Dify Has Broken Access Control on Log Message Endpoint Allows Reading of Chats of Others	Exploitation statusPublic exploit	FixYes	Affected productdify	Published09/25/2025	SeverityMedium
`CVE-2025-3467`XSS Vulnerability in langgenius/dify	Exploitation statusPublic exploit	FixYes	Affected productlanggenius/dify	Published07/07/2025	SeverityHigh
`CVE-2025-3466`Unsanitized Input in langgenius/dify	Exploitation statusPublic exploit	FixYes	Affected productlanggenius/dify	Published07/07/2025	SeverityCritical
`CVE-2025-49149`Dify has XSS vulnerability	Exploitation statusPublic exploit	FixNot confirmed	Affected productdify	Published06/17/2025	SeverityMedium
`CVE-2025-43854`DIFY vulnerable to Clickjacking Attack	Exploitation statusPublic exploit	FixYes	Affected productdify	Published04/28/2025	SeverityLow
`CVE-2025-43862`Dify Allows Unauthorized Access and Modification of APP Orchestration	Exploitation statusNot known exploited	FixYes	Affected productdify	Published04/25/2025	SeverityHigh
`CVE-2025-32796`Dify Allows Unauthorized APP Enable/Disable via API	Exploitation statusPublic exploit	FixYes	Affected productdify	Published04/18/2025	SeverityMedium
`CVE-2025-32795`Dify Allows Insecure User Role Access Control for APP Editing	Exploitation statusPublic exploit	FixYes	Affected productdify	Published04/18/2025	SeverityMedium
`CVE-2025-32790`Dify Allows Insecure User Role Access Control for APP DSL Exporting	Exploitation statusPublic exploit	FixYes	Affected productdify	Published04/18/2025	SeverityMedium
`CVE-2025-29720`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published04/14/2025	SeverityMedium
`CVE-2025-0184`Server-Side Request Forgery (SSRF) in langgenius/dify	Exploitation statusPublic exploit	FixYes	Affected productlanggenius/dify	Published03/20/2025	SeverityMedium
`CVE-2024-11850`Stored XSS in langgenius/dify	Exploitation statusPublic exploit	FixNot confirmed	Affected productlanggenius/dify	Published03/20/2025	SeverityMedium
`CVE-2024-12776`Authentication Bypass in langgenius/dify	Exploitation statusPublic exploit	FixNot confirmed	Affected productlanggenius/dify	Published03/20/2025	SeverityHigh
`CVE-2024-10252`Code Injection in langgenius/dify	Exploitation statusPublic exploit	FixYes	Affected productlanggenius/dify	Published03/20/2025	SeverityHigh
`CVE-2024-12039`Improper Restriction of Excessive Authentication Attempts in langgenius/dify	Exploitation statusPublic exploit	FixNot confirmed	Affected productlanggenius/dify	Published03/20/2025	SeverityHigh
`CVE-2024-12775`SSRF in langgenius/dify	Exploitation statusPublic exploit	FixNot confirmed	Affected productlanggenius/dify	Published03/20/2025	SeverityMedium
`CVE-2024-11822`Server-Side Request Forgery (SSRF) in langgenius/dify	Exploitation statusPublic exploit	FixNot confirmed	Affected productlanggenius/dify	Published03/20/2025	SeverityMedium
`CVE-2025-0185`Pandas Query Injection in langgenius/dify	Exploitation statusPublic exploit	FixNot confirmed	Affected productlanggenius/dify	Published03/20/2025	SeverityHigh
`CVE-2024-11824`Stored XSS in langgenius/dify	Exploitation statusPublic exploit	FixYes	Affected productlanggenius/dify	Published03/20/2025	SeverityMedium
`CVE-2024-11821`Privilege Escalation in langgenius/dify	Exploitation statusPublic exploit	FixNot confirmed	Affected productlanggenius/dify	Published03/20/2025	SeverityMedium
`CVE-2025-1796`Admin account takeover through weak Pseudo-Random number generator used in generating password reset codes in langgenius/dify	Exploitation statusPublic exploit	FixNot confirmed	Affected productlanggenius/dify	Published03/20/2025	SeverityHigh

45 / 45 Results

All vulnerabilities loaded

Security vulnerabilities from langgenius

langgenius

How many security vulnerabilities does langgenius have?

Which langgenius product has the most security vulnerabilities?

Filters

Run an in-depth assessment with complete web risk management

Popular langgenius products

dify

langgenius/dify