AnythingLLM

Patch now: confirmed exploitation or KEV · 0

Records at severity 3–4 (exploitation confirmed by CISA, the vendor or reporting) and records flagged as listed in CISA KEV. The KEV flag is the classifier’s cisa-kev tag or a source on the KEV catalog; it is recorded when the collector sees the listing, so a missing flag does not mean a CVE is absent from the catalog.

No record for AnythingLLM has confirmed exploitation or a KEV flag.

Disclosed CVEs, no confirmed exploitation · 25

1. 2026-09-10
   CVE-2026-88055

   AnythingLLM Stored Vulnerability in System Preferences

   2 Disclosedanythingllm

   record AIR-2026-1354NVD ↗
2. 2026-08-10
   CVE-2026-72917

   Authentication Vulnerability in AnythingLLM Recovery Flow

   2 Disclosedauth-bypass · anythingllm

   record AIR-2026-0072NVD ↗
3. 2026-06-24
   CVE-2026-48789

   CVE-2026-48789: AnythingLLM path traversal vulnerability on Windows

   2 Disclosedpath-traversal

   record AIR-2026-1128NVD ↗
4. 2026-06-24
   CVE-2026-55611

   CVE-2026-55611: AnythingLLM missing ownership check on file deletion endpoint

   2 Disclosedauthorization-bypass

   record AIR-2026-1127NVD ↗
5. 2026-05-28
   CVE-2026-47713

   AnythingLLM Authentication Flaw Permits Unauthorized Workspace Access

   2 Disclosedauthentication_bypass · data_leak

   record AIR-2026-1096NVD ↗
6. 2026-05-28
   CVE-2026-45403

   CVE-2026-45403: File copy traversal vulnerability in AnythingLLM

   2 Disclosedpath-traversal · symlink

   record AIR-2026-1095NVD ↗
7. 2026-05-28
   CVE-2026-48116

   CVE-2026-48116: Script execution vulnerability in AnythingLLM agent skill

   2 Disclosedcommand-injection · agent-tool

   record AIR-2026-1094NVD ↗
8. 2026-05-08
   CVE-2026-42456

   CVE-2026-42456: Insecure direct object reference in AnythingLLM tts endpoint

   2 Disclosedidor · data_leak

   record AIR-2026-1070NVD ↗
9. 2026-04-24
   CVE-2026-41318

   AnythingLLM unescaped markdown chart captions vulnerability

   2 Disclosedanythingllm · markdown

   record AIR-2026-1047NVD ↗
10. 2026-03-16
    CVE-2026-32719

    CVE-2026-32719: AnythingLLM Zip Slip Path Traversal Vulnerability

    2 Disclosedzip-slip · path-traversal

    record AIR-2026-0993NVD ↗
11. 2026-03-16
    CVE-2026-32628

    CVE-2026-32628: AnythingLLM SQL Injection in SQL Agent

    2 Disclosedsql-injection

    record AIR-2026-0992NVD ↗
12. 2026-03-16
    CVE-2026-32715

    CVE-2026-32715: AnythingLLM Privilege Escalation and Credential Exposure

    2 Disclosedprivilege-escalation

    record AIR-2026-0991NVD ↗
13. 2026-03-16
    CVE-2026-32717

    CVE-2026-32717: API key bypass for suspended users in AnythingLLM

    2 Disclosedbroken-access-control · api-key

    record AIR-2026-0990NVD ↗
14. 2026-03-16
    CVE-2026-32626

    CVE-2026-32626: XSS to RCE vulnerability in AnythingLLM desktop chat

    2 Disclosedxss · rce · electron

    record AIR-2026-0989NVD ↗
15. 2026-03-16
    CVE-2026-32617

    CVE-2026-32617: Authentication bypass and loose CORS in AnythingLLM

    2 Disclosedauth-bypass · cors

    record AIR-2026-0988NVD ↗
16. 2026-01-27
    CVE-2026-24478

    CVE-2026-24478: AnythingLLM Path Traversal Leading to RCE

    2 Disclosedanythingllm · path-traversal · rce

    record AIR-2026-0953NVD ↗
17. 2026-01-27
    CVE-2026-24477

    CVE-2026-24477: AnythingLLM API Key Exposure Vulnerability

    2 Disclosedanythingllm · qdrant · api-key-leak

    record AIR-2026-0952NVD ↗
18. 2026-01-03
    CVE-2026-21484

    AnythingLLM Password Recovery Username Enumeration Flaw

    2 Disclosedenumeration

    record AIR-2026-0934NVD ↗
19. 2025-12-18
    CVE-2025-63390

    CVE-2025-63390: Authentication bypass in AnythingLLM workspace API

    2 Disclosedanythingllm

    record AIR-2025-0041NVD ↗
20. 2025-03-20
    CVE-2024-13060

    CVE-2024-13060: Access control flaw in AnythingLLM profile picture access

    2 Disclosedbroken-access-control

    record AIR-2025-0412NVD ↗
21. 2024-04-10
    CVE-2024-3570

    CVE-2024-3570: Stored Cross-Site Scripting in AnythingLLM

    2 Disclosedxss · stored-xss

    record AIR-2024-0224NVD ↗
22. 2024-03-03
    CVE-2024-0765

    CVE-2024-0765: AnythingLLM Data Exfiltration Vulnerability

    2 Discloseddata-exfiltration

    record AIR-2024-0217NVD ↗
23. 2024-02-27
    CVE-2024-0759

    Internal link-scraping SSRF vulnerability in AnythingLLM

    2 Disclosedssrf · anythingllm

    record AIR-2024-0215NVD ↗
24. 2024-02-26
    CVE-2024-0455

    CVE-2024-0455: AnythingLLM web scraper metadata credential exposure

    2 Disclosedssrf · anythingllm

    record AIR-2024-0209NVD ↗
25. 2024-01-19
    CVE-2024-22422

    CVE-2024-22422: AnythingLLM unauthenticated API route denial of service

    2 Discloseddenial-of-service · anythingllm

    record AIR-2024-0208NVD ↗