MMintplex-Labs

Products

Exploited and recent CVEs

• CVE-2026-88055 Medium 5.5 AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator 0.3%
• CVE-2026-72917 Medium 5.9 AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization 0.3%
• CVE-2026-55611 None 0.0 AnythingLLM: embed-parsed-file cleanup deletes any parsed file by ID without ownership scoping (cross-tenant IDOR deletion) 0.3%
• CVE-2026-48789 Medium 4.3 AnythingLLM: Windows path containment bypass in document folder route 0.3%
• CVE-2026-47713 Low 2.0 AnythingLLM: Legacy mobile device tokens bypass multi-user workspace scoping after mode migration 0.2%
• CVE-2026-48116 High 7.5 AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill 0.4%
• CVE-2026-45403 Low 2.0 AnythingLLM: filesystem-copy-file follows nested symlinks and copies files from outside the allowed directory 0.2%
• CVE-2026-42456 Medium 4.3 AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (IDOR) 0.3%
• CVE-2026-41318 Medium 5.4 AnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable component 0.2%
• CVE-2026-5627 Critical 9.1 Path Traversal in mintplex-labs/anything-llm 0.8%
• CVE-2026-32719 Medium 4.2 AnythingLLM has a Zip Slip Path Traversal and Code Execution via Community Hub Plugin Import 0.4%
• CVE-2026-32717 Low 2.7 AnythingLLM access control bypass: suspended users can continue using Browser Extension API keys 0.2%
• CVE-2026-32715 Low 3.8 AnythingLLM Manager Privilege Bypass Allows Access to Admin-Only System Preferences 0.2%
• CVE-2026-32628 High 7.7 AnythingLLM has SQL Injection in Built-in SQL Agent Plugin via Unsanitized table_name Parameter 0.3%
• CVE-2026-32626 Critical 9.7 AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection 0.8%
• CVE-2026-32617 High 7.1 AnythingLLM Permissable CORS policy 0.4%
• CVE-2026-24478 High 7.2 AnythingLLM vulnerable to Path Traversal 0.9%
• CVE-2026-24477 High 8.7 AnythingLLM has key leak in `systemSettings.js` 2.1%
• CVE-2026-21484 Medium 5.3 AnythingLLM Vulnerable to Username Enumeration w/ Password Recovery 0.8%
• CVE-2024-8196 Critical 9.8 Missing Authentication for Critical Function in mintplex-labs/anything-llm 0.8%
• CVE-2024-8248 High 7.2 Path Traversal in mintplex-labs/anything-llm 0.9%
• CVE-2024-6842 High 7.5 Exposure of Sensitive Information in mintplex-labs/anything-llm 36.3%
• CVE-2024-10513 High 7.2 Path Traversal in mintplex-labs/anything-llm 0.9%
• CVE-2024-8249 High 7.5 Unauthenticated Denial of Service (DoS) in mintplex-labs/anything-llm 0.7%
• CVE-2024-10109 High 8.3 Incorrect Authorization in mintplex-labs/anything-llm 0.5%
• CVE-2024-7771 Medium 6.5 Denial of Service in mintplex-labs/anything-llm 0.8%
• CVE-2024-8251 Medium 5.3 Prisma Injection in mintplex-labs/anything-llm 0.5%
• CVE-2024-13060 Medium 4.3 Improper Authorization in mintplex-labs/anything-llm 0.5%
• CVE-2024-13059 High 7.2 Path Traversal in mintplex-labs/anything-llm 24.3%
• CVE-2024-7783 Medium 5.9 Improper Storage of Sensitive Information in Bearer Token in mintplex-labs/anything-llm 0.3%