https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T00:40:31.520663+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-308468 EUVD-2026-308468 2026-10-07T00:40:31.550617+00:00 EUVD-2026-308468 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42138 fkie_cve-2026-42138 2026-10-07T00:40:31.550650+00:00

Dify is an open-source LLM app development platform. Prior to version 1.13.1, using the method POST /api/files/upload, any unauthenticated user can upload an SVG file with XSS. The method POST /v1/files/upload, which requires authentication through the application API, is also vulnerable. This issue has been patched in version 1.13.1.