Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 406,677All CVEsplus 19,172 rejected
- 95Last 24 hours4,555 in the last 7 days
- 16,051Last 30 days1,407 of them critical
- 1,781Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 2 | 6 | 14 | 0 | 0 | 22 | 44 |
| 2025 | 1 | 7 | 12 | 2 | 0 | 22 | 22 |
| Title | ||
|---|---|---|
| CVE-2026-58141 | Dify < 1.15.0 SSRF Protection Bypass via Remote-Files Endpointslanggenius · dify | High7.2 |
| CVE-2026-123135 | langgenius dify Sandbox Run __init__.py hard-coded credentialsPublic exploitlanggenius · dify | Medium5.3 |
| CVE-2026-105762 | Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpointPublic exploitlanggenius · dify | High8.3 |
| CVE-2026-105761 | Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Serverslanggenius · dify | High7.1 |
| CVE-2026-85022 | langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scriptingPublic exploitlanggenius · dify | Medium5.1 |
| CVE-2026-85021 | langgenius dify Splash Layout splash.tsx router.replace cross site scriptingPublic exploitlanggenius · dify | Medium5.3 |
| CVE-2026-18632 | langgenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template enginePublic exploitlanggenius · dify | Medium5.3 |
| CVE-2026-18266 | Dify AI Workflow oauth_redirect_url Open Redirect VulnerabilityLangGenius · Dify | Medium5.4 |
| CVE-2026-61461 | Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_textPublic exploitlanggenius · dify | High8.7 |
| CVE-2026-41949 | Dify < 1.14.2 Authorization Bypass via File Preview EndpointPublic exploitlanggenius · dify | High8.2 |
| CVE-2026-41948 | Dify v1.14.1 Path Traversal via Plugin Daemon Internal API AccessPublic exploitlanggenius · dify | Critical9.3 |
| CVE-2026-41947 | Dify < 1.14.2 Authorization Bypass via Trace Configuration EndpointsPublic exploitlanggenius · dify | Critical9.3 |
| CVE-2026-41950 | Dify < 1.14.0 Authorization Bypass via File UUIDPublic exploitlanggenius · dify | Medium6.0 |
| CVE-2026-42138 | Dify Vulnerable to Stored XSS via SVG-file uploadPublic exploitlanggenius · dify | Medium6.9 |
| CVE-2026-34082 | Dify has IDOR in deleting someone else's chat conversationPublic exploitlanggenius · dify | Medium5.3 |
| CVE-2026-6619 | langgenius dify ImagePreview image-preview.tsx openInNewTab cross site scriptingPublic exploitlanggenius · dify | Medium5.1 |
| CVE-2026-6618 | langgenius dify ApiBasedToolSchemaParser parser.py parse_openai_plugin_json_to_tool_bundle server-side request forgeryPublic exploitlanggenius · dify | Medium5.3 |
| CVE-2026-6617 | langgenius dify ApiToolManageService api_tools_manage_service.py get_api_tool_provider_remote_schema server-side request forgeryPublic exploitlanggenius · dify | Medium5.3 |
| CVE-2026-21866 | Dify - Stored XSS in chatPublic exploitlanggenius · dify | Medium5.1 |
| CVE-2026-28288 | Dify has a user enumeration issuePublic exploitlanggenius · dify | Medium5.5 |
| CVE-2026-26023 | Client‑side DOM XSS in the web chat app of Dify when using echartsPublic exploitlanggenius · dify | Medium5.3 |
| CVE-2025-67732 | Dify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration Endpointlanggenius · dify | High8.4 |
| CVE-2025-11750 | User Enumeration via Distinct Error Messages in langgenius/dify-webPublic exploitlanggenius · langgenius/dify | Medium4.3 |
| CVE-2025-58747 | Dify MCP OAuth Flow Vulnerable to XSSPublic exploitlanggenius · dify | Low2.0 |
| CVE-2025-59422 | Dify Has Broken Access Control on Log Message Endpoint Allows Reading of Chats of OthersPublic exploitlanggenius · dify | Medium6.0 |
| CVE-2025-3467 | XSS Vulnerability in langgenius/difyPublic exploitlanggenius · langgenius/dify | High8.0 |
| CVE-2025-3466 | Unsanitized Input in langgenius/difyPublic exploitlanggenius · langgenius/dify | Critical9.8 |
| CVE-2025-49149 | Dify has XSS vulnerabilityPublic exploitlanggenius · dify | Medium5.3 |
| CVE-2025-43854 | DIFY vulnerable to Clickjacking AttackPublic exploitlanggenius · dify | Low2.3 |
| CVE-2025-43862 | Dify Allows Unauthorized Access and Modification of APP Orchestrationlanggenius · dify | High7.6 |
| CVE-2025-32796 | Dify Allows Unauthorized APP Enable/Disable via APIPublic exploitlanggenius · dify | Medium6.5 |
| CVE-2025-32795 | Dify Allows Insecure User Role Access Control for APP EditingPublic exploitlanggenius · dify | Medium6.5 |
| CVE-2025-32790 | Dify Allows Insecure User Role Access Control for APP DSL ExportingPublic exploitlanggenius · dify | Medium6.3 |
| CVE-2025-0184 | Server-Side Request Forgery (SSRF) in langgenius/difyPublic exploitlanggenius · langgenius/dify | Medium6.5 |
| CVE-2024-11850 | Stored XSS in langgenius/difyPublic exploitlanggenius · langgenius/dify | Medium6.8 |
| CVE-2024-12776 | Authentication Bypass in langgenius/difyPublic exploitlanggenius · langgenius/dify | High8.1 |
| CVE-2024-10252 | Code Injection in langgenius/difyPublic exploitlanggenius · langgenius/dify | High8.8 |
| CVE-2024-12039 | Improper Restriction of Excessive Authentication Attempts in langgenius/difyPublic exploitlanggenius · langgenius/dify | High7.4 |
| CVE-2024-12775 | SSRF in langgenius/difyPublic exploitlanggenius · langgenius/dify | Medium6.5 |
| CVE-2024-11822 | Server-Side Request Forgery (SSRF) in langgenius/difyPublic exploitlanggenius · langgenius/dify | Medium6.5 |
| CVE-2025-0185 | Pandas Query Injection in langgenius/difyPublic exploitlanggenius · langgenius/dify | High8.8 |
| CVE-2024-11824 | Stored XSS in langgenius/difyPublic exploitlanggenius · langgenius/dify | Medium5.8 |
| CVE-2024-11821 | Privilege Escalation in langgenius/difyPublic exploitlanggenius · langgenius/dify | Medium4.3 |
| CVE-2025-1796 | Admin account takeover through weak Pseudo-Random number generator used in generating password reset codes in langgenius/difyPublic exploitlanggenius · langgenius/dify | High7.5 |