# Langgenius vulnerabilities Source: https://junglewise.ai/threats/vendors/langgenius Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/langgenius.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 17 vulnerabilities in Langgenius: 0 in the last 7 days and 4 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-123135, was published on 5 November 2026. 1 vulnerability in the last four weeks, level on the four before (1). 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 4 - All time: 17 (3 critical, 0 exploited in the wild) ## About Langgenius LangGenius is the developer of Dify, an open-source platform for building LLM applications. ## Latest Langgenius vulnerabilities - [CVE-2026-123135: langgenius dify hard-coded credentials in sandbox](https://junglewise.ai/threats/cve-2026-123135-a-vulnerability-was-found-in-langgenius-dify-up-to-1-18-0-2-0-0) (medium, CVSS 6.3, published 5 Nov 2026) - [CVE-2026-105761: Dify authorization bypass in MCP server endpoint](https://junglewise.ai/threats/cve-2026-105761-dify-is-an-open-source-llm-app-development-platform-prior-to-1) (high, CVSS 7.1, published 5 Oct 2026) - [CVE-2026-85022: langgenius dify DOM-based XSS in redirect URL handler](https://junglewise.ai/threats/cve-2026-85022-langgenius-dify-dom-based-xss-in-redirect-url-handler) (low, CVSS 3.5, published 3 Sep 2026) - [CVE-2026-85021: langgenius Dify DOM-based XSS in splash.tsx redirect](https://junglewise.ai/threats/cve-2026-85021-langgenius-dify-dom-based-xss-in-splash-tsx-redirect) (medium, CVSS 4.3, published 3 Sep 2026) - [CVE-2026-18632: LangGenius Dify server-side template injection in Jinja2 handler](https://junglewise.ai/threats/cve-2026-18632-langgenius-dify-server-side-template-injection-in-jinja2-handler) (medium, CVSS 6.3, published 3 Aug 2026) - [CVE-2026-18266: LangGenius Dify open redirect in AppInitializer OAuth flow](https://junglewise.ai/threats/cve-2026-18266-langgenius-dify-open-redirect-in-appinitializer-oauth-flow) (medium, CVSS 5.4, published 29 Jul 2026) - [CVE-2026-61461: langgenius Dify SQL injection in MyScale vector store backend](https://junglewise.ai/threats/cve-2026-61461-langgenius-dify-sql-injection-in-myscale-vector-store-backend) (high, CVSS 8.8, published 10 Jul 2026) - [CVE-2026-41949: LangGenius Dify authorization bypass in file preview endpoint](https://junglewise.ai/threats/cve-2026-41949-langgenius-dify-authorization-bypass-in-file-preview-endpoint) (medium, CVSS 5.9, published 18 May 2026) - [CVE-2026-41948: LangGenius Dify path traversal in Plugin Daemon internal API](https://junglewise.ai/threats/cve-2026-41948-langgenius-dify-path-traversal-in-plugin-daemon-internal-api) (high, CVSS 7.7, published 18 May 2026) - [CVE-2026-41947: Dify authorization bypass in trace configuration endpoints](https://junglewise.ai/threats/cve-2026-41947-dify-authorization-bypass-in-trace-configuration-endpoints) (high, CVSS 7.4, published 18 May 2026) - [CVE-2026-41950: LangGenius Dify authorization bypass in chat-messages endpoint](https://junglewise.ai/threats/cve-2026-41950-langgenius-dify-authorization-bypass-in-chat-messages-endpoint) (medium, CVSS 6.5, published 5 May 2026) - [CVE-2026-42138: LangGenius Dify stored XSS via SVG file upload](https://junglewise.ai/threats/cve-2026-42138-langgenius-dify-stored-xss-via-svg-file-upload) (medium, CVSS 6.1, published 4 May 2026) - [CVE-2025-63387: Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to…](https://junglewise.ai/threats/cve-2025-63387-pysec-2025-103-dify-v1-9-1-is-vulnerable-to-insecure-permissions) (high, CVSS 7.5, published 18 Dec 2025) - [CVE-2025-56157: LangGenius Dify hardcoded credentials in PostgreSQL Docker configuration](https://junglewise.ai/threats/cve-2025-56157-langgenius-dify-hardcoded-credentials-in-postgresql-docker) (critical, CVSS 9.8, published 18 Dec 2025) - [CVE-2025-63388: A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the…](https://junglewise.ai/threats/cve-2025-63388-a-cross-origin-resource-sharing-cors-misconfiguration) (critical, CVSS 9.1, published 18 Dec 2025) - [CVE-2025-63386: A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup…](https://junglewise.ai/threats/cve-2025-63386-a-cross-origin-resource-sharing-cors-misconfiguration) (critical, CVSS 9.1, published 18 Dec 2025) - [CVE-2025-11750: In langgenius/dify-web version 1.6.0, the authentication mechanism reveals the existence of user accounts by returning…](https://junglewise.ai/threats/cve-2025-11750-in-langgenius-dify-web-version-1-6-0-the-authentication-mechanism) (medium, CVSS 5.3, published 22 Oct 2025) ## Most severe Langgenius vulnerabilities - [CVE-2025-56157: LangGenius Dify hardcoded credentials in PostgreSQL Docker configuration](https://junglewise.ai/threats/cve-2025-56157-langgenius-dify-hardcoded-credentials-in-postgresql-docker) (critical, CVSS 9.8, published 18 Dec 2025) - [CVE-2025-63386: A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup…](https://junglewise.ai/threats/cve-2025-63386-a-cross-origin-resource-sharing-cors-misconfiguration) (critical, CVSS 9.1, published 18 Dec 2025) - [CVE-2025-63388: A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the…](https://junglewise.ai/threats/cve-2025-63388-a-cross-origin-resource-sharing-cors-misconfiguration) (critical, CVSS 9.1, published 18 Dec 2025) - [CVE-2026-61461: langgenius Dify SQL injection in MyScale vector store backend](https://junglewise.ai/threats/cve-2026-61461-langgenius-dify-sql-injection-in-myscale-vector-store-backend) (high, CVSS 8.8, published 10 Jul 2026) - [CVE-2026-41948: LangGenius Dify path traversal in Plugin Daemon internal API](https://junglewise.ai/threats/cve-2026-41948-langgenius-dify-path-traversal-in-plugin-daemon-internal-api) (high, CVSS 7.7, published 18 May 2026) - [CVE-2025-63387: Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to…](https://junglewise.ai/threats/cve-2025-63387-pysec-2025-103-dify-v1-9-1-is-vulnerable-to-insecure-permissions) (high, CVSS 7.5, published 18 Dec 2025) - [CVE-2026-41947: Dify authorization bypass in trace configuration endpoints](https://junglewise.ai/threats/cve-2026-41947-dify-authorization-bypass-in-trace-configuration-endpoints) (high, CVSS 7.4, published 18 May 2026) - [CVE-2026-105761: Dify authorization bypass in MCP server endpoint](https://junglewise.ai/threats/cve-2026-105761-dify-is-an-open-source-llm-app-development-platform-prior-to-1) (high, CVSS 7.1, published 5 Oct 2026) - [CVE-2026-41950: LangGenius Dify authorization bypass in chat-messages endpoint](https://junglewise.ai/threats/cve-2026-41950-langgenius-dify-authorization-bypass-in-chat-messages-endpoint) (medium, CVSS 6.5, published 5 May 2026) - [CVE-2026-18632: LangGenius Dify server-side template injection in Jinja2 handler](https://junglewise.ai/threats/cve-2026-18632-langgenius-dify-server-side-template-injection-in-jinja2-handler) (medium, CVSS 6.3, published 3 Aug 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, level on the four before (1). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 2 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Langgenius technologies - [Langgenius Dify](https://junglewise.ai/threats/technologies/dify): 17 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Langgenius vulnerabilities", https://junglewise.ai/threats/vendors/langgenius, 13 November 2026.