Vulnerabilities

TI-2026-46223 CVE-2026-64677

Anki's local HTTP server is vulnerable to directory traversal attacks

LOW 28

Anki is a program for creating and reviewing flashcards.

CVSS 4.0MEDIUM 5.9 Network No auth User interaction EPSS 0.01018 Published 2026-08-06 No fix listed CWE-22

TI-2026-41958 CVE-2026-58266

Anki: User scripts in iframes have access to the internal Anki API

LOW 28

Anki is a program for creating and reviewing flashcards.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00221 Published 2026-07-07 Fixed in 25.09.4 CWE-346

TI-2026-42319 CVE-2026-59153 · GHSA-869j-r97x-hx2g

Anki's local HTTP server does not sufficiently validate requests

LOW 11

Anki is a program for creating and reviewing flashcards.

CVSS 4.0LOW 2.1 Network No auth User interaction EPSS 0.00264 Published 2026-07-07 Fixed in 25.09.3, 25.9.3 CWE-346

TI-2025-38505 CVE-2025-62187 · GHSA-cvrh-qggv-7gf8

Path traversal in Ankitects Anki

LOW 15

In Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written to arbitrary locations on Windows and Linux (media file pathnames are not necessarily relative to the media folder).

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00181 Published 2025-10-07 Fixed in 25.02.6 CWE-23

TI-2025-38504 CVE-2025-62186 · GHSA-jjrh-4jr8-87g7

Ankitects Anki before 25.02.5 allows a crafted shared deck on Windows to execute…

LOW 33

Ankitects Anki before 25.02.5 allows a crafted shared deck on Windows to execute arbitrary commands when playing audio because of URL scheme mishandling.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00145 Published 2025-10-07 Fixed in 25.02.5 CWE-829

TI-2025-38503 CVE-2025-62185 · GHSA-j6hh-cgvw-j237

Uncontrolled search path in Ankitects Anki

LOW 33

In Ankitects Anki before 25.02.5, a crafted shared deck can place a YouTube downloader executable in the media folder, and this is executed for a YouTube link in the deck.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00155 Published 2025-10-07 Fixed in 25.02.5 CWE-427

TI-2025-28297 CVE-2025-43703 · GHSA-634v-x2r3-jm25

An issue was discovered in Ankitects Anki through 25.02.

LOW 27

An issue was discovered in Ankitects Anki through 25.02.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00234 Published 2025-04-16 No fix listed CWE-830

TI-2024-19251 CVE-2024-29073 · GHSA-x3r6-ccvq-cf5v

An vulnerability in the handling of Latex exists in Ankitects Anki 24.04.

MEDIUM 62

An vulnerability in the handling of Latex exists in Ankitects Anki 24.04.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.11826 Published 2024-07-22 Fixed in 24.6 CWE-829

TI-2024-17117 CVE-2024-26020 · GHSA-9gq7-p5w9-w899

Injection in Ankitects Anki

HIGH 76

An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.15186 Published 2024-07-22 Fixed in 24.06 CWE-74

TI-2024-21226 CVE-2024-32152 · GHSA-q47p-v5rw-v574

A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki…

MEDIUM 53

A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.12252 Published 2024-07-22 Fixed in 24.6 CWE-184

TI-2024-21378 CVE-2024-32484 · GHSA-r6f4-5657-3fp7

Cross-site scripting in Ankitects Anki

HIGH 69

An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.2149 Published 2024-07-22 No fix listed CWE-80

Vulnerabilities

Filters