CVE-2026-123135Medium· 6.3▾ SunlitA vulnerability was found in langgenius dify up to 1.18.0/2.0.0-beta.2. Affected by this vulnerability is an unknown functionality of the file api/configs/feature/__init__.py of the component Sandbox Run Handler. The manipulation results…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A vulnerability was found in langgenius dify up to 1.18.0/2.0.0-beta.2. Affected by this vulnerability is an unknown functionality of the file api/configs/feature/init.py of the component Sandbox Run Handler. The manipulation results in hard-coded credentials. The attack can be launched remotely. The exploit has been made public and could be used.
dify 1.0dify 1.1dify 1.2dify 1.3dify 1.4dify 1.5dify 1.6dify 1.7dify 1.8dify 1.9dify 1.10dify 1.11dify 1.12dify 1.13dify 1.14dify 1.15dify 1.16dify 1.17dify 1.18.0dify 2.0.0-beta.0dify 2.0.0-beta.1dify 2.0.0-beta.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-56157Critical· 9.8Default credentials in Dify thru 1.5.1
CVE-2026-105762High· 8.3Dify is an open-source LLM app development platform
CVE-2026-105761High· 7.1Dify is an open-source LLM app development platform
CVE-2025-63387High· 7.5Dify v1.9.1 is vulnerable to Insecure Permissions
CVE-2026-61461High· 8.8Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the search_by_full_text method without escapin…
CVE-2026-121609Critical· 10.0Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials