Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 9 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,861All CVEsplus 19,116 rejected
- 448Last 24 hours2,917 in the last 7 days
- 16,804Last 30 days1,554 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 2 | 5 | 7 | 4 | 1 | 19 | 77 |
| 2025 | 1 | 6 | 3 | 0 | 0 | 10 | 58 |
| 2024 | 12 | 19 | 10 | 1 | 1 | 43 | 48 |
| 2023 | 1 | 4 | 0 | 0 | 0 | 5 | 5 |
| Title | ||
|---|---|---|
| CVE-2026-88055 | AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGeneratorMintplex-Labs · anything-llm | Medium5.5 |
| CVE-2026-72917 | AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalizationMintplex-Labs · anything-llm | Medium5.9 |
| CVE-2026-55611 | AnythingLLM: embed-parsed-file cleanup deletes any parsed file by ID without ownership scoping (cross-tenant IDOR deletion)Mintplex-Labs · anything-llm | None0.0 |
| CVE-2026-48789 | AnythingLLM: Windows path containment bypass in document folder routeMintplex-Labs · anything-llm | Medium4.3 |
| CVE-2026-47713 | AnythingLLM: Legacy mobile device tokens bypass multi-user workspace scoping after mode migrationMintplex-Labs · anything-llm | Low2.0 |
| CVE-2026-48116 | AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skillMintplex-Labs · anything-llm | High7.5 |
| CVE-2026-45403 | AnythingLLM: filesystem-copy-file follows nested symlinks and copies files from outside the allowed directoryMintplex-Labs · anything-llm | Low2.0 |
| CVE-2026-42456 | AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (IDOR)Mintplex-Labs · anything-llm | Medium4.3 |
| CVE-2026-41318 | AnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable componentMintplex-Labs · anything-llm | Medium5.4 |
| CVE-2026-5627 | Path Traversal in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | Critical9.1 |
| CVE-2026-32719 | AnythingLLM has a Zip Slip Path Traversal and Code Execution via Community Hub Plugin ImportMintplex-Labs · anything-llm | Medium4.2 |
| CVE-2026-32717 | AnythingLLM access control bypass: suspended users can continue using Browser Extension API keysMintplex-Labs · anything-llm | Low2.7 |
| CVE-2026-32715 | AnythingLLM Manager Privilege Bypass Allows Access to Admin-Only System PreferencesMintplex-Labs · anything-llm | Low3.8 |
| CVE-2026-32628 | AnythingLLM has SQL Injection in Built-in SQL Agent Plugin via Unsanitized table_name ParameterMintplex-Labs · anything-llm | High7.7 |
| CVE-2026-32626 | AnythingLLM has a Streaming Phase XSS to RCE via LLM Response InjectionMintplex-Labs · anything-llm | Critical9.7 |
| CVE-2026-32617 | AnythingLLM Permissable CORS policyMintplex-Labs · anything-llm | High7.1 |
| CVE-2026-24478 | AnythingLLM vulnerable to Path TraversalMintplex-Labs · anything-llm | High7.2 |
| CVE-2026-24477 | AnythingLLM has key leak in `systemSettings.js`Mintplex-Labs · anything-llm | High8.7 |
| CVE-2026-21484 | AnythingLLM Vulnerable to Username Enumeration w/ Password RecoveryMintplex-Labs · anything-llm | Medium5.3 |
| CVE-2024-8196 | Missing Authentication for Critical Function in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | Critical9.8 |
| CVE-2024-8248 | Path Traversal in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | High7.2 |
| CVE-2024-6842 | Exposure of Sensitive Information in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | High7.5 |
| CVE-2024-10513 | Path Traversal in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | High7.2 |
| CVE-2024-8249 | Unauthenticated Denial of Service (DoS) in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | High7.5 |
| CVE-2024-10109 | Incorrect Authorization in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | High8.3 |
| CVE-2024-7771 | Denial of Service in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | Medium6.5 |
| CVE-2024-8251 | Prisma Injection in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | Medium5.3 |
| CVE-2024-13060 | Improper Authorization in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | Medium4.3 |
| CVE-2024-13059 | Path Traversal in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | High7.2 |
| CVE-2024-7783 | Improper Storage of Sensitive Information in Bearer Token in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | Medium5.9 |
| CVE-2024-3279 | Improper Access Control in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | Critical9.1 |
| CVE-2024-5216 | Denial of Service in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | High7.5 |
| CVE-2024-5213 | Exposure of Sensitive Information in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | Medium5.3 |
| CVE-2024-5208 | Uncontrolled Resource Consumption in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | Medium6.5 |
| CVE-2024-5211 | Path Traversal to Arbitrary File Read/Delete/Overwrite, DoS Attack, and Admin Account Takeover in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | Critical9.1 |
| CVE-2024-3150 | Privilege Escalation in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | High8.1 |
| CVE-2024-3149 | SSRF in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | Critical9.6 |
| CVE-2024-3153 | Uncontrolled Resource Consumption in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | Medium6.5 |
| CVE-2024-3166 | Cross-Site Scripting (XSS) Vulnerability in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | Low3.4 |
| CVE-2024-3102 | JSON Injection in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | Medium5.3 |
| CVE-2024-3110 | Stored XSS leading to admin account takeover in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | High7.3 |
| CVE-2024-3104 | Remote Code Execution in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | Critical9.6 |
| CVE-2024-3033 | Improper Authorization in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | Critical9.1 |
| CVE-2024-3152 | Privilege Escalation and Local File Inclusion in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | High8.8 |
| CVE-2024-4084 | SSRF vulnerability in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | High7.7 |
| CVE-2024-4286 | Improper Neutralization of Special Elements in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | Medium4.9 |
| CVE-2024-4287 | Improper Input Validation in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | High8.1 |
| CVE-2024-4284 | Denial of Service in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | Medium4.9 |
| CVE-2024-2913 | Race Condition Vulnerability in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | Medium6.5 |
| CVE-2024-3029 | Improper Input Validation in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm | Critical9.0 |