2
CVEs
0
Critical
0
High
0
KEV
2
PoC
0
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
0
LOW
2
Monthly CVE Trend
Affected Products (7)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-85021 | Cross-site scripting in Dify 1.13.0 allows unauthenticated remote attackers to inject arbitrary client-side script via the redirect_url argument processed by the router.replace function in the Splash Layout component. Exploitation requires a single user interaction - the victim must follow a crafted link - but no account or prior access to the Dify instance is required. A public proof-of-concept exploit was disclosed on GitHub Gist on or around 2026-07-05; the vendor did not respond to the coordinated disclosure, and no confirmed patch is available at time of analysis. | LOW | 2.1 | 0.4% | 31 |
PoC
No patch
|
| CVE-2026-85022 | Cross-site scripting in Dify 1.13.0's WebApp Sign-In component allows remote attackers to inject malicious JavaScript by manipulating the redirect_url parameter consumed by the router.replace() function. The attack requires passive victim interaction with a crafted sign-in URL and low attacker privileges, limiting the immediate impact to integrity modification within the browser context. A public proof-of-concept exploit exists, and the vendor did not respond to coordinated disclosure, leaving no official patch available at time of analysis. | LOW | 2.0 | 0.3% | 30 |
PoC
No patch
|