LIVE · cybersecurity feed
Live wire
ASOS Breach Reveals the Risks in Customer-Facing SaaSUnpatched AhsayCBS flaws exploited to deploy webshells, mine cryptoAI Training Critical as Governance Challenges GrowUS Disrupts Chinese State-Sponsored Hacking ToolsCitrix warns admins to patch new NetScaler RCE flaw immediatelyCisco Patches a Dozen Critical VulnerabilitiesCisco warns of critical flaws allowing Nexus switch takeoverCVE-2026-21589 · Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)Cyber experts call on CISA to create mandatory federal OT rulesGremlin Foresight AI finds system weaknesses and verifies the fixes
cve recordcriticalexploit reported

CVE-2026-41948

dify · dify

Published
CVSS9.4
Severitycritical
WeaknessCWE-23
EPSS1.9%79.4th percentile
Exploited1 KEV source

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

patch window

Called exploited 106 days after disclosure.

Measured from the CVE publication date to the earliest of 1 KEV catalogue that list it.

The life of this vulnerability

  1. CVE published
  2. First KEV listing4mo
  3. Last sightingsame day

Gaps are compressed to equal steps. The elapsed time is printed under each.

Which catalogues call it exploited

Sources1 of 3
Listings differ by—
Strongest claimconfirmed

This rests on a single catalogue. No second catalogue corroborates the claim that it is being exploited. CIRCL is an aggregator and is not counted.

Public exploitation evidence

1 public report collected from VulnCheck and CIRCL, first on Sep 1, 2026. Each links to its original source. We have not verified them.

Description

Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitization. Attackers can traverse out of their authorized tenant path using unencoded dot sequences in task identifiers or manipulated filename parameters to access internal endpoints such as debug interfaces, requiring only knowledge of the victim tenant's UUID. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker.

References

← Back to the CVE Tracker

Our coverage of CVE-2026-41948

CVE-2026-20245high

Texas Parks and Wildlife, WordPress Plugin Vendor Hit by Data Breaches

The Texas Parks and Wildlife Department has confirmed a data breach affecting its hunting and fishing license system vendor, exposing personal information for over 3 million customers. Separately, ShapedPlugin, a vendor of WordPress plugins, suffered a supply chain attack that delivered malicious updates to its paid plugins.

CVE-2026-20245high

29th June – Threat Intelligence Report

A recent threat intelligence report has detailed a range of cyber incidents, from supply chain attacks and data breaches affecting major companies to the exploitation of artificial intelligence technologies for malicious purposes. The report highlights the ongoing evolution of cyber threats, emphasizing the need for robust security measures across various sectors.