Mintplex-labs vulnerabilities

Products

• Mintplex-labs/anything-llm 57
• Anything-llm 19
• Mintplex-labs\/anything-llm 3

Newest

• mintplex-labs anything-llm AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator CVE-2026-88055 5.5 MediumSeptember 10, 2026
• mintplex-labs anything-llm AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization CVE-2026-72917 5.9 MediumAugust 10, 2026
• mintplex-labs anything-llm AnythingLLM: embed-parsed-file cleanup deletes any parsed file by ID without ownership scoping (cross-tenant IDOR deletion) CVE-2026-55611 0.0 NoneJune 24, 2026
• mintplex-labs anything-llm AnythingLLM: Windows path containment bypass in document folder route CVE-2026-48789 4.3 MediumJune 24, 2026
• mintplexlabs anythingllm, mintplex-labs anything-llm +1 more AnythingLLM: Legacy mobile device tokens bypass multi-user workspace scoping after mode migration CVE-2026-47713 2.0 LowMay 28, 2026
• mintplexlabs anythingllm, mintplex-labs anything-llm +1 more AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill CVE-2026-48116 7.5 HighMay 28, 2026
• mintplexlabs anythingllm, mintplex-labs anything-llm +1 more AnythingLLM: filesystem-copy-file follows nested symlinks and copies files from outside the allowed directory CVE-2026-45403 2.0 LowMay 28, 2026
• mintplexlabs anythingllm, mintplex-labs anything-llm +1 more AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (IDOR) CVE-2026-42456 4.3 MediumMay 8, 2026
• mintplexlabs anythingllm, mintplex-labs anything-llm +1 more AnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable component CVE-2026-41318 5.4 MediumApril 24, 2026
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more Path Traversal in mintplex-labs/anything-llm CVE-2026-5627 9.1 CriticalApril 7, 2026
• mintplexlabs anythingllm, mintplex-labs anything-llm +1 more AnythingLLM has a Zip Slip Path Traversal and Code Execution via Community Hub Plugin Import CVE-2026-32719 4.2 MediumMarch 13, 2026
• mintplexlabs anythingllm, mintplex-labs anything-llm +1 more AnythingLLM access control bypass: suspended users can continue using Browser Extension API keys CVE-2026-32717 2.7 LowMarch 13, 2026
• mintplexlabs anythingllm, mintplex-labs anything-llm +1 more AnythingLLM Manager Privilege Bypass Allows Access to Admin-Only System Preferences CVE-2026-32715 3.8 LowMarch 13, 2026
• mintplexlabs anythingllm, mintplex-labs anything-llm +1 more AnythingLLM has SQL Injection in Built-in SQL Agent Plugin via Unsanitized table_name Parameter CVE-2026-32628 7.7 HighMarch 13, 2026
• mintplexlabs anythingllm, mintplex-labs anything-llm +1 more AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection CVE-2026-32626 9.7 CriticalMarch 13, 2026
• mintplexlabs anythingllm, mintplex-labs anything-llm +1 more AnythingLLM Permissable CORS policy CVE-2026-32617 7.1 HighMarch 13, 2026
• mintplexlabs anythingllm, mintplex-labs anything-llm +1 more AnythingLLM vulnerable to Path Traversal CVE-2026-24478 7.2 HighJanuary 26, 2026
• mintplexlabs anythingllm, mintplex-labs anything-llm +1 more AnythingLLM has key leak in `systemSettings.js` CVE-2026-24477 8.7 HighJanuary 26, 2026
• mintplexlabs anythingllm, mintplex-labs anything-llm +1 more AnythingLLM Vulnerable to Username Enumeration w/ Password Recovery CVE-2026-21484 5.3 MediumJanuary 3, 2026
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm desktop +1 more Missing Authentication for Critical Function in mintplex-labs/anything-llm CVE-2024-8196 9.8 CriticalMarch 20, 2025
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more Path Traversal in mintplex-labs/anything-llm CVE-2024-8248 7.2 HighMarch 20, 2025
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more Exposure of Sensitive Information in mintplex-labs/anything-llm CVE-2024-6842 EPSS 36.3% 7.5 HighMarch 20, 2025
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more Path Traversal in mintplex-labs/anything-llm CVE-2024-10513 7.2 HighMarch 20, 2025
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more Unauthenticated Denial of Service (DoS) in mintplex-labs/anything-llm CVE-2024-8249 7.5 HighMarch 20, 2025
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more Incorrect Authorization in mintplex-labs/anything-llm CVE-2024-10109 8.3 HighMarch 20, 2025
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more Denial of Service in mintplex-labs/anything-llm CVE-2024-7771 6.5 MediumMarch 20, 2025
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more Prisma Injection in mintplex-labs/anything-llm CVE-2024-8251 5.3 MediumMarch 20, 2025
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm docker +1 more Improper Authorization in mintplex-labs/anything-llm CVE-2024-13060 4.3 MediumMarch 20, 2025
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more Path Traversal in mintplex-labs/anything-llm CVE-2024-13059 EPSS 24.3% 7.2 HighFebruary 10, 2025
• mintplex-labs mintplex-labs/anything-llm, miniplex labs labs\/anything lim, mintplexlabs anythingllm +2 more Improper Storage of Sensitive Information in Bearer Token in mintplex-labs/anything-llm CVE-2024-7783 5.9 MediumOctober 29, 2024
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more Improper Access Control in mintplex-labs/anything-llm CVE-2024-3279 9.1 CriticalAugust 9, 2024
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more Denial of Service in mintplex-labs/anything-llm CVE-2024-5216 7.5 HighJune 25, 2024
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more Exposure of Sensitive Information in mintplex-labs/anything-llm CVE-2024-5213 5.3 MediumJune 20, 2024
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more Uncontrolled Resource Consumption in mintplex-labs/anything-llm CVE-2024-5208 6.5 MediumJune 19, 2024
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more Path Traversal to Arbitrary File Read/Delete/Overwrite, DoS Attack, and Admin Account Takeover in mintplex-labs/anything-llm CVE-2024-5211 9.1 CriticalJune 12, 2024
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anything-llm, anythingllm +2 more Privilege Escalation in mintplex-labs/anything-llm CVE-2024-3150 8.1 HighJune 6, 2024
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more SSRF in mintplex-labs/anything-llm CVE-2024-3149 9.6 CriticalJune 6, 2024
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more Uncontrolled Resource Consumption in mintplex-labs/anything-llm CVE-2024-3153 6.5 MediumJune 6, 2024
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm desktop, anythingllm docker +2 more Cross-Site Scripting (XSS) Vulnerability in mintplex-labs/anything-llm CVE-2024-3166 3.4 LowJune 6, 2024
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more JSON Injection in mintplex-labs/anything-llm CVE-2024-3102 5.3 MediumJune 6, 2024
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more Stored XSS leading to admin account takeover in mintplex-labs/anything-llm CVE-2024-3110 7.3 HighJune 6, 2024
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more Remote Code Execution in mintplex-labs/anything-llm CVE-2024-3104 9.6 CriticalJune 6, 2024
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more Improper Authorization in mintplex-labs/anything-llm CVE-2024-3033 9.1 CriticalJune 6, 2024
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more Privilege Escalation and Local File Inclusion in mintplex-labs/anything-llm CVE-2024-3152 8.8 HighJune 6, 2024
• mintplex-labs mintplex-labs/anything-llm, mintplex-labs\/anything-llm, mintplexlabs anythingllm +2 more SSRF vulnerability in mintplex-labs/anything-llm CVE-2024-4084 7.7 HighJune 5, 2024
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more Improper Neutralization of Special Elements in mintplex-labs/anything-llm CVE-2024-4286 4.9 MediumMay 26, 2024
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more Improper Input Validation in mintplex-labs/anything-llm CVE-2024-4287 8.1 HighMay 20, 2024
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more Denial of Service in mintplex-labs/anything-llm CVE-2024-4284 4.9 MediumMay 19, 2024
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm, multiplex-labs +2 more Race Condition Vulnerability in mintplex-labs/anything-llm CVE-2024-2913 6.5 MediumMay 6, 2024
• mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more Improper Input Validation in mintplex-labs/anything-llm CVE-2024-3029 9.0 CriticalApril 16, 2024
• Show olderLoading…