anki

8 results · Feed

• Medium 5.9
  CVE-2026-64677

  Anki's local HTTP server is vulnerable to directory traversal attacks

  Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined wit…

  ankitects anki anki Ubuntu
  Aug 6, 2026
• Medium 6.5
  CVE-2026-58266

  Anki: User scripts in iframes have access to the internal Anki API

  Anki is a program for creating and reviewing flashcards. Prior to 25.09.4, Anki's webview-based pages communicate with the Rust backend using an internal localhost API, and user scripts included via iframes in the editor can access this API despite protection…

  ankitects anki anki aqt Ubuntu PyPI
  Jul 7, 2026
• Low 2.1
  CVE-2026-59153

  Anki's local HTTP server does not sufficiently validate requests

  Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, Anki launches a local HTTP server to serve media files and web pages for parts of its interface, but requests from other origins were not sufficiently blocked. A malicious website coul…

  ankitects anki anki aqt Ubuntu PyPI
  Jul 7, 2026
• Medium 6.1
  CVE-2025-43703

  An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access…

  ankitects anki anki Ubuntu
  Apr 16, 2025
• Medium 5.3
  CVE-2024-29073 EPSS 12%

  Anki Latex Incomplete Blocklist Vulnerability

  An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. When Latex is sanitized to prevent unsafe commands, the verbatim package, which comes installed by default in many Latex distributions, has been overlooked. A specially crafted flashcar…

  ankitects anki anki anki Debian Ubuntu PyPI
  Jul 22, 2024
• Low 3.1
  CVE-2024-32152 EPSS 12%

  Ankitects Anki LaTeX Blocklist Bypass vulnerability

  A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. A specially crafted malicious flashcard can lead to an arbitrary file creation at a fixed path. An attacker can share a malicious flashcard to trigger this vulnerabili…

  ankitects anki anki anki Debian Ubuntu PyPI
  Jul 22, 2024
• Critical 9.6
  CVE-2024-26020 EPSS 15%

  Ankitects Anki arbitrary script execution vulnerability

  An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code execution. An attacker can send malicious flashcard to trigger this vulnerability.

  ankitects anki anki anki Debian Ubuntu PyPI
  Jul 22, 2024
• High 7.4
  CVE-2024-32484 EPSS 21%

  An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A s…

  ankitects anki anki anki Debian Ubuntu
  Jul 22, 2024