D
Vendor security profile
dify
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs16
Critical5
CISA KEV0
Public exploit13
Patch rate%38
Avg. CVSS7.4
12-month vulnerability rate
0
4
1
0
0
0
4
0
1
1
0
2
CVE KEV
CVE severity distribution
16toplam CVE
Critical5 (31%)
High5 (31%)
Medium5 (31%)
Low1 (6%)
Patch and exploitation view
%38
Verified patch
%0
CISA KEV
%81
Public exploit
6Patch available
0Partial
0Workaround
0Vendor: no patch
10Unknown
Latest vulnerabilities
7.2
CVE-2026-85679
Extendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key
E
Patch status unknownEPSS %0
9.8
CVE-2026-18143
Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler
A
Patch status unknown Public Exploits:1EPSS %0
9.8
CVE-2026-15369
Custom User Registration Fields for WooCommerce <= 2.2.3 - Unauthenticated Privilege Escalation via 'afreg_select_user_role' Parameter in Store API Checkout
A
Patch status unknownEPSS %0
8.8
CVE-2026-62857
Fedify: Server-Side Request Forgery in getNodeInfo() Allows Access to Internal Network Resources
F
Patch status unknownEPSS %0
8.7
CVE-2026-61461
Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text
L
Patch verifiedEPSS %0
7.5
CVE-2026-41949
Vulnerability in Dify
D
Patch verified Public Exploits:1EPSS %1
9.4
CVE-2026-41948
Vulnerability in Dify
D
Patch verified Public Exploits:2EPSS %2
9.1
CVE-2026-41947
Vulnerability in Dify
D
Patch verified Public Exploits:1EPSS %1
6.5
CVE-2025-67732
Information exposure in Dify
D
Patch status unknown Public Exploits:1EPSS %0
7.5
CVE-2025-68475
Regular expression denial of service in Fedify
F
Patch verified Public Exploits:1EPSS %1