AN
Product
anything-llm
19
CVEs
0
On KEV
9.6
Max CVSS
0
New 30D
Severity mix
Critical 1High 6Medium 8Low 3
Watch
Add anything-llm to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-48116 | 8.8 | May 28 | AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill Affected: < 1.13.0 |
| CVE-2026-32628 | 8.8 | Mar 13 | AnythingLLM has SQL Injection in Built-in SQL Agent Plugin via Unsanitized table_name Parameter Affected: <= 1.11.1 |
| CVE-2026-32617 | 7.5 | Mar 13 | AnythingLLM Permissable CORS policy Affected: <= 1.11.1 |
| CVE-2026-24477 | 7.5 | Jan 26 | AnythingLLM has key leak in `systemSettings.js` Affected: < 1.10.0 |
| CVE-2024-22422 | 7.5 | Jan 19 | Unauthenticated Denial of Service (DOS) attack in AnythingLLM Affected: < 08d33cfd8 |
| CVE-2026-24478 | 7.2 | Jan 26 | AnythingLLM vulnerable to Path Traversal Affected: < 1.10.0 |
Showing 6