CVE Tools
Track your stack

Anythingllm

68 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Anythingllm, a product in the ai ml space. Use it to gauge the current risk picture and drill into individual advisories.

Anythingllm CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Anythingllm CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-021
2025-038
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-121
2026-013
2026-020
2026-036
2026-042
2026-054
2026-060
2026-070
2026-080
2026-090
2026-100

Severity

How the 68 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical812%
  • High3551%
  • Medium2131%
  • Low46%

Latest CVEs

The 15 most recently published vulnerabilities affecting Anythingllm.

  1. CVE-2026-47713AnythingLLM: Legacy mobile device tokens bypass multi-user workspace scoping after mode migration2.0
  2. CVE-2026-48116AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill7.5
  3. CVE-2026-45403AnythingLLM: filesystem-copy-file follows nested symlinks and copies files from outside the allowed directory2.0
  4. CVE-2026-42456AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (IDOR)4.3
  5. CVE-2026-41318AnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable component5.4
  6. CVE-2026-5627Path Traversal in mintplex-labs/anything-llm7.2
  7. CVE-2026-32719AnythingLLM has a Zip Slip Path Traversal and Code Execution via Community Hub Plugin Import4.2
  8. CVE-2026-32717AnythingLLM access control bypass: suspended users can continue using Browser Extension API keys2.7
  9. CVE-2026-32715AnythingLLM Manager Privilege Bypass Allows Access to Admin-Only System Preferences3.8
  10. CVE-2026-32628AnythingLLM has SQL Injection in Built-in SQL Agent Plugin via Unsanitized table_name Parameter8.8
  11. CVE-2026-32626AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection9.6
  12. CVE-2026-32617AnythingLLM Permissable CORS policy7.1
  13. CVE-2026-24478AnythingLLM vulnerable to Path Traversal7.2
  14. CVE-2026-24477AnythingLLM has key leak in `systemSettings.js`7.5
  15. CVE-2026-21484AnythingLLM Vulnerable to Username Enumeration w/ Password Recovery5.3

Product grouping is registry-driven, with AI assist and human review. How it works