CVE-2026-21484
Medium · 5.3CVSS
5.3
EPSS
0.8%
Published
Jan 3, 2026
CISA due date
—
The record
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to commit e287fab56089cf8fcea9ba579a3ecdeca0daa313, the password recovery endpoint returns different error messages depending on whether a username exists, so enabling username enumeration. Commit e287fab56089cf8fcea9ba579a3ecdeca0daa313 fixes this issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-88834 A flaw was found in BusyBox's httpd web server. CWE-203
- CVE-2026-87620 Observable discrepancy in SVG in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-203
- CVE-2026-87623 Observable discrepancy in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-203
- CVE-2026-87619 Observable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allowed a… CWE-203
- CVE-2026-87566 Observable discrepancy in Layout in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-203
- CVE-2026-87539 Observable discrepancy in Network in Google Chrome prior to 153.0.8010.36 allowed a… CWE-203
- CVE-2026-87516 Observable discrepancy in Navigation in Google Chrome prior to 153.0.8010.36 allowed a… CWE-203
- CVE-2026-87518 Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 153.0.8010.36… CWE-203