Skip to main content
Dify Logo/Enterprise

api-insecure Security Scan

View Release Notes
Securityv3.13.1Generated 2026-10-22 03:23:44 UTC
Critical
24 found
High
73 found
Scan Date
Oct 22, 2026

Scanner: Docker Scout

Critical vulnerabilities: 10

High vulnerabilities: 49

Medium vulnerabilities: 24

Critical

CVEPackageInstalledFixedDescription
CVE-2026-78663net0.57.01.26.9CVE-2026-78663
CVE-2026-78663net0.57.01.26.9CVE-2026-78663
GHSA-6q48-6c7w-9gw2certifi2025.11.122026.10.19GHSA-6q48-6c7w-9gw2: Improper Certificate Validation
GHSA-6q48-6c7w-9gw2certifi2025.11.122026.10.19GHSA-6q48-6c7w-9gw2: Improper Certificate Validation
CVE-2026-112393pillow12.3.013.0.0CVE-2026-112393: Heap-based Buffer Overflow
CVE-2026-112403pillow12.3.013.0.0CVE-2026-112403: Heap-based Buffer Overflow
CVE-2026-112900pillow12.3.013.0.0CVE-2026-112900: Improper Neutralization of Special Elements used in an OS Command ('OS Command Inje...
CVE-2026-45833chromadb0.5.20not fixedCVE-2026-45833: Improper Control of Generation of Code ('Code Injection')
CVE-2026-39821stdlib1.26.51.26.6CVE-2026-39821
CVE-2026-56857stdlib1.26.51.26.9CVE-2026-56857

High

CVEPackageInstalledFixedDescription
CVE-2026-33818stdlib1.26.51.26.6CVE-2026-33818
CVE-2026-46600stdlib1.26.51.26.6CVE-2026-46600
CVE-2026-56853stdlib1.26.51.26.6CVE-2026-56853
CVE-2026-56855crypto0.55.00.56.0CVE-2026-56855
CVE-2026-56859stdlib1.26.51.26.6CVE-2026-56859
CVE-2026-56862stdlib1.26.51.26.6CVE-2026-56862
CVE-2026-56866stdlib1.26.51.26.9CVE-2026-56866
CVE-2026-57585msgpack1.1.21.2.1CVE-2026-57585
CVE-2026-78659net0.57.01.26.9CVE-2026-78659
CVE-2026-78659net0.57.01.26.9CVE-2026-78659
CVE-2026-78660net0.57.01.26.9CVE-2026-78660
CVE-2026-78660net0.57.01.26.9CVE-2026-78660
CVE-2026-78662crypto0.55.00.56.0CVE-2026-78662
CVE-2026-78667stdlib1.26.51.26.9CVE-2026-78667
CVE-2026-78669net0.57.01.26.9CVE-2026-78669
CVE-2026-78669net0.57.01.26.9CVE-2026-78669
CVE-2026-94439stdlib1.26.51.26.9CVE-2026-94439
CVE-2026-94440stdlib1.26.51.26.9CVE-2026-94440
CVE-2026-97031stdlib1.26.51.26.9CVE-2026-97031
CVE-2026-97032net0.57.01.26.9CVE-2026-97032
CVE-2026-97032net0.57.01.26.9CVE-2026-97032
GHSA-6v7p-g79w-8964msgpack1.1.21.2.1GHSA-6v7p-g79w-8964: Use After Free
CVE-2026-97687urllib32.7.02.8.0CVE-2026-97687: Improper Certificate Validation
CVE-2025-47273setuptools70.3.078.1.1CVE-2025-47273: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-111064aiohttp3.14.33.14.4CVE-2026-111064: Allocation of Resources Without Limits or Throttling
CVE-2026-111066aiohttp3.14.33.14.4CVE-2026-111066: Uncontrolled Resource Consumption
CVE-2026-112390pillow12.3.013.0.0CVE-2026-112390: Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2026-112392pillow12.3.013.0.0CVE-2026-112392: NULL Pointer Dereference
CVE-2026-112893pillow12.3.013.0.0CVE-2026-112893: Use of Uninitialized Variable
CVE-2026-81726nltk3.10.3not fixedCVE-2026-81726: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-112397pillow12.3.013.0.0CVE-2026-112397: Out-of-bounds Write
CVE-2026-112399pillow12.3.013.0.0CVE-2026-112399: Memory Allocation with Excessive Size Value
CVE-2026-112400pillow12.3.013.0.0CVE-2026-112400: Uncontrolled Resource Consumption
CVE-2026-112402pillow12.3.013.0.0CVE-2026-112402: Use After Free
CVE-2026-112405pillow12.3.013.0.0CVE-2026-112405: NULL Pointer Dereference
CVE-2026-112406pillow12.3.013.0.0CVE-2026-112406: Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2026-112892pillow12.3.013.0.0CVE-2026-112892: Improper Handling of Highly Compressed Data (Data Amplification)
CVE-2026-112894pillow12.3.013.0.0CVE-2026-112894: Inefficient Algorithmic Complexity
CVE-2026-112895pillow12.3.013.0.0CVE-2026-112895: Uncontrolled Recursion
CVE-2026-112897pillow12.3.013.0.0CVE-2026-112897: Use of Uninitialized Resource
CVE-2026-84304grpc1.83.01.83.1CVE-2026-84304: Uncontrolled Resource Consumption
CVE-2026-84445grpc1.83.01.83.2CVE-2026-84445: Improper Validation of Array Index
GHSA-2g87-pp6c-29x5aiohttp3.14.33.14.4GHSA-2g87-pp6c-29x5: Allocation of Resources Without Limits or Throttling
CVE-2026-112404pillow12.3.013.0.0CVE-2026-112404: Out-of-bounds Read
CVE-2026-112896pillow12.3.013.0.0CVE-2026-112896: Out-of-bounds Read
CVE-2026-112902pillow12.3.013.0.0CVE-2026-112902: Function Call With Incorrect Argument Type
CVE-2026-45830chromadb0.5.20not fixedCVE-2026-45830: Incorrect Privilege Assignment
CVE-2026-45831chromadb0.5.20not fixedCVE-2026-45831: Incorrect Authorization
CVE-2026-97689urllib32.7.02.8.0CVE-2026-97689: Allocation of Resources Without Limits or Throttling

Medium

CVEPackageInstalledFixedDescription
CVE-2023-49092rsa0.9.10not fixedCVE-2023-49092
CVE-2026-112396pillow12.3.013.0.0CVE-2026-112396: Use After Free
CVE-2026-56860stdlib1.26.51.26.6CVE-2026-56860
CVE-2026-113792pypdf6.19.06.20.1CVE-2026-113792: Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2026-113793pypdf6.19.06.20.1CVE-2026-113793: Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2026-113794pypdf6.19.06.20.0CVE-2026-113794: Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2026-113795pypdf6.19.06.20.0CVE-2026-113795: Uncontrolled Resource Consumption
CVE-2026-56858stdlib1.26.51.26.6CVE-2026-56858
CVE-2026-59890setuptools70.3.083.0.0CVE-2026-59890: Improper Handling of Unicode Encoding
CVE-2026-94448stdlib1.26.51.26.9CVE-2026-94448
CVE-2026-97030stdlib1.26.51.26.9CVE-2026-97030
CVE-2026-111748aiohttp3.14.33.14.4CVE-2026-111748: Reliance on Untrusted Inputs in a Security Decision
CVE-2026-111750aiohttp3.14.33.14.4CVE-2026-111750: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CVE-2026-112391pillow12.3.013.0.0CVE-2026-112391: Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2026-112394pillow12.3.013.0.0CVE-2026-112394: Buffer Over-read
CVE-2026-84303grpc1.83.01.83.1CVE-2026-84303: Improper Handling of Case Sensitivity
CVE-2026-112395pillow12.3.013.0.0CVE-2026-112395: Heap-based Buffer Overflow
CVE-2026-111065aiohttp3.14.33.14.4CVE-2026-111065: Allocation of Resources Without Limits or Throttling
CVE-2026-112401pillow12.3.013.0.0CVE-2026-112401: Inefficient Algorithmic Complexity
CVE-2026-112891pillow12.3.013.0.0CVE-2026-112891: Inefficient Algorithmic Complexity
CVE-2026-112898pillow12.3.013.0.0CVE-2026-112898: Use of Uninitialized Variable
CVE-2026-112899pillow12.3.013.0.0CVE-2026-112899: Allocation of Resources Without Limits or Throttling
CVE-2026-112901pillow12.3.013.0.0CVE-2026-112901: Inefficient Regular Expression Complexity
CVE-2026-97688urllib32.7.02.8.0CVE-2026-97688: Loop with Unreachable Exit Condition ('Infinite Loop')
© 2026 Dify All rights reserved.Enterprise release information is confidential. Do not distribute externally.
Documentation
Support
Contact