Login Request a demo
AN
Product
anything-llm
by Mintplex-Labs · last CVE Sep 10, 2026
19
CVEs
0
On KEV
9.6
Max CVSS
0
New 30D
Vulnerabilities19In the news0Timeline
Severity mix
Critical 1High 6Medium 8Low 3
Severity
All severities19Critical1High6Medium8Low3
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add anything-llm to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-32719
6.4
0%
Mar 13
AnythingLLM has a Zip Slip Path Traversal and Code Execution via Community Hub Plugin Import
Affected: <= 1.11.1
CVE-2026-72917
5.9
0%
Aug 10
AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization
Affected: Affected versions >= 1.0.0, <= 1.15.0
CVE-2026-88055
5.5
0%
Sep 10
AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator
Affected: <= 1.16.1
CVE-2026-41318
5.4
0%
Apr 24
AnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable component
Affected: < 1.12.1
CVE-2026-21484
5.3
1%
Jan 3
AnythingLLM Vulnerable to Username Enumeration w/ Password Recovery
Affected: < e287fab56089cf8fcea9ba579a3ecdeca0daa313
CVE-2026-48789
4.3
0%
Jun 24
AnythingLLM: Windows path containment bypass in document folder route
Affected: < 1.13.0
CVE-2026-47713
4.3
0%
May 28
AnythingLLM: Legacy mobile device tokens bypass multi-user workspace scoping after mode migration
Affected: < 1.13.0
CVE-2026-42456
4.3
0%
May 8
AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (IDOR)
Affected: < 1.12.1
Showing 8