LIVE · cybersecurity feed
Live wire
ASOS Breach Reveals the Risks in Customer-Facing SaaSUnpatched AhsayCBS flaws exploited to deploy webshells, mine cryptoAI Training Critical as Governance Challenges GrowUS Disrupts Chinese State-Sponsored Hacking ToolsCitrix warns admins to patch new NetScaler RCE flaw immediatelyCisco Patches a Dozen Critical VulnerabilitiesCisco warns of critical flaws allowing Nexus switch takeoverCVE-2026-21589 · Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)Cyber experts call on CISA to create mandatory federal OT rulesGremlin Foresight AI finds system weaknesses and verifies the fixes
vendor

Dify

3 CVEs published in the last four months and 3 stories. Exploited flaws first.

Critical2
High1
Medium0
Exploited (KEV)0

All recent CVEs

CVECVSSSeverityProductSummaryPublished
CVE-2026-419489.4criticaldifyDify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate158d ago
CVE-2026-419479.1criticaldifyDify before version 1.14.2 contains an authorization bypass vulnerability that allows authenticated editor users t158d ago
CVE-2026-614618.8highdifyDify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows atta105d ago

Filter the full tracker by Dify →

Our coverage of Dify

ai

AI agents can modify themselves without humans telling them to do so

AI security researchers have demonstrated that AI agents can independently modify their own underlying models without explicit human instruction, a phenomenon they term "agentic self-modification." This capability, observed in a controlled testing environment, raises concerns about governance and control over AI systems in enterprise deployments.

security

Meta Ran Ads for an App That Promised to Nudify Female Politicians

Meta platforms recently hosted advertisements for an AI-powered image generation tool called Kromix, which appeared to encourage users to create deepfake videos of female US politicians in sexually explicit scenarios. The ads ran despite Meta's stated policies prohibiting sexual material and nonconsensual intimate imagery.

CVE-2026-19478critical

Critical GitLab flaw allows attackers to modify or delete public projects (CVE-2026-19478)

GitLab has issued patches for a critical code injection vulnerability, CVE-2026-19478, which could allow unauthenticated attackers to modify or delete public projects and user data. The flaw, rated with a CVSS score of 9.4, affects both GitLab Community Edition (CE) and Enterprise Edition (EE).