llm-foundry (>=0.9.1, <=0.10.0), mlflow-pytorch-exp (0.0.1) potentially affected by CVE-2026-33865 +1 more via mlflow (2.14.3)

mlflow PYPI version 2.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry =0.9.1, =0.10.0 - mlflow-pytorch-exp 0.0.1 Source cves: CVE-2026-33865, CVE-2026-33866 Source advisory: OSV:PYSEC-2026-94...

databricks-genai (>=1.1.0, <=2.0.0a9), llm-foundry (>=0.12.0, <=0.14.5) +5 more potentially affected by CVE-2026-33865 via mlflow (2.16.2)

mlflow PYPI version 2.16.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.1.0, =0.12.0, =0.0.3.post33, =0.0.16, =0.9.35rc0, =0.8.7, =0.8.8 Source cves: CVE-2026-33865 Source advisory: OSV:PYSEC-2026-93...

llm-foundry (>=0.9.1, <=0.10.0), mlflow-pytorch-exp (0.0.1) potentially affected by CVE-2026-33865 via mlflow (2.14.3)

mlflow PYPI version 2.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry =0.9.1, =0.10.0 - mlflow-pytorch-exp 0.0.1 Source cves: CVE-2026-33865 Source advisory: OSV:PYSEC-2026-93...

llm-foundry (0.11.0), modeva (>=1.0.14, <=2.1.0) potentially affected by CVE-2026-33865 via mlflow (2.15.1)

mlflow PYPI version 2.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry 0.11.0 - modeva =1.0.14, =2.1.0 Source cves: CVE-2026-33865 Source advisory: OSV:PYSEC-2026-93...

azureml-evaluate-mlflow (>=0.0.57, <=0.0.58), eensight (>=1.0.0, <=1.0.2) +6 more potentially affected by CVE-2026-33865 via mlflow (2.12.2)

mlflow PYPI version 2.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-evaluate-mlflow =0.0.57, =1.0.0, =0.8.0, =0.0.6, =0.6.0.dev0, =0.10.0, =0.10.2 Source cves: CVE-2026-33865 Source advisory: OSV:PYSEC-2026-...

databricks-genai (>=1.2.0a0, <=1.2.0a6), deeptrees (>=1.6.0, <=1.8.2) +1 more potentially affected by CVE-2026-33865 via mlflow (2.18.0)

mlflow PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.2.0a0, =1.6.0, =0.15.1, =0.18.0 Source cves: CVE-2026-33865 Source advisory: OSV:PYSEC-2026-93...

CVE-2026-5627

A path traversal vulnerability exists in mintplex-labs/anything-llm versions up to and including 1.9.1, within the "AgentFlows" component. The vulnerability arises from improper handling of user input in the "loadFlow" and "deleteFlow" methods in "server/utils/agentFlows/index.js". Specifically,...

CVE-2026-5627

The CVE-2026-5627 issue affects mintplex-labs/anything-llm up to version 1.9.1, specifically in the AgentFlows component. The vulnerability stems from improper handling of user input in loadFlow and deleteFlow (server/utils/agentFlows/index.js), where path.join combined with normalizePath can byp...

CVE-2026-5627

A path traversal vulnerability exists in mintplex-labs/anything-llm versions up to and including 1.9.1, within the AgentFlows component. The vulnerability arises from improper handling of user input in the loadFlow and deleteFlow methods in server/utils/agentFlows/index.js. Specifically, the...

CVE-2026-5627 Path Traversal in mintplex-labs/anything-llm

A path traversal vulnerability exists in mintplex-labs/anything-llm versions up to and including 1.9.1, within the AgentFlows component. The vulnerability arises from improper handling of user input in the loadFlow and deleteFlow methods in server/utils/agentFlows/index.js. Specifically, the...

dynamic-prompting (>=0.2.4, <=0.2.6), embedprepro (>=0.1.0, <=0.12.0) +6 more potentially affected by CVE-2026-1839 via transformers (4.41.1)

transformers PYPI version 4.41.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - dynamic-prompting =0.2.4, =0.1.0, =4.2.4, =0.1.0, =0.0.23, =0.0.4, =0.0.6 Source cves: CVE-2026-1839 Source advisory:...

serverless-llm-store (0.5.0), turbo-alignment (0.0.2) potentially affected by CVE-2026-1839 via transformers (4.42.0)

transformers PYPI version 4.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - serverless-llm-store 0.5.0 - turbo-alignment 0.0.2 Source cves: CVE-2026-1839 Source advisory: OSV:GHSA-69W3-R845-3855...

autotrain-advanced (>=0.6.52, <=0.6.80), bicleaner-ai (>=3.0.1, <=3.2.1) +5 more potentially affected by CVE-2026-1839 via transformers (4.36.1)

transformers PYPI version 4.36.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - autotrain-advanced =0.6.52, =3.0.1, =0.1.4, =0.0.2, =0.0.12 Source cves: CVE-2026-1839 Source advisory: OSV:GHSA-69W3-R845-3855...

autotrain-advanced (>=0.7.102, <=0.7.118), genrag (0.1.0) +9 more potentially affected by CVE-2026-1839 via transformers (4.41.0)

transformers PYPI version 4.41.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - autotrain-advanced =0.7.102, =0.1.10, =0.1.0, =0.0.9, =0.0.3.post33, =0.0.1, =0.0.1, =0.0.90, =2.5.1, =2.5.5 Source cves: CVE-2026-1839...

chain-guardrail (>=0.0.10, <=0.0.11), dulu (0.1.4) +10 more potentially affected by CVE-2026-1839 via transformers (4.42.3)

transformers PYPI version 4.42.3 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - chain-guardrail =0.0.10, =0.1.3, =1.0.1, =0.0.5, =0.3.4, =1.0.0, =2.5.9, =2.6.2 Source cves: CVE-2026-1839 Source advisory:...

alignment-handbook (0.1.0), geniebottle (0.0.3) +7 more potentially affected by CVE-2026-1839 via transformers (4.37.1)

transformers PYPI version 4.37.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - alignment-handbook 0.1.0 - geniebottle 0.0.3 - llm-docstring-generator 1.0.0 - lmdeploy =0.2.3, =0.0.2, =0.0.6, =0.0.7 - video2dataset...

autotrain-advanced (>=0.6.52, <=0.6.80), bicleaner-ai (>=3.0.1, <=3.2.1) +5 more potentially affected by CVE-2026-1839 via transformers (4.36.1)

transformers PYPI version 4.36.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - autotrain-advanced =0.6.52, =3.0.1, =0.1.4, =0.0.2, =0.0.12 Source cves: CVE-2026-1839 Source advisory: OSV:PYSEC-2026-2288...

serverless-llm-store (0.5.0), turbo-alignment (0.0.2) potentially affected by CVE-2026-1839 via transformers (4.42.0)

transformers PYPI version 4.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - serverless-llm-store 0.5.0 - turbo-alignment 0.0.2 Source cves: CVE-2026-1839 Source advisory: OSV:PYSEC-2026-2288...

CritBench: A Framework for Evaluating Cybersecurity Capabilities of Large Language Models in IEC 61850 Digital Substation Environments

The advancement of Large Language Models LLMs has raised concerns regarding their dual-use potential in cybersecurity. Existing evaluation frameworks overwhelmingly focus on Information Technology IT environments, failing to capture the constraints, and specialized protocols of Operational...

Anything-llm security vulnerabilities

anything-llm is an integrated desktop and Docker AI application developed by Mintplex. Versions of anything-llm prior to 1.9.1 contain security vulnerabilities. These vulnerabilities stem from the improper handling of user input by the AgentFlows component, which may lead to path traversal attack...