VendorsMintplex Labsanythingllmany version
Vulnerabilities

Mintplex Labs AnythingLLM any version

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

65CVEs
CVE-2024-3025
Path Traversal in mintplex-labs/anything-llm
Published 2024-04-10 · Analyzed
9.9EPSS 0.010
CVE-2024-0455
SSRF on AWS deployed instances of AnythingLLM via /metadata
Published 2024-02-25 · Analyzed
9.9EPSS 0.008
CVE-2024-3104
Remote Code Execution in mintplex-labs/anything-llm
Published 2024-06-06 · Modified
9.8EPSS 0.010
CVE-2023-4897
Relative Path Traversal in mintplex-labs/anything-llm
Published 2023-09-11 · Modified
9.8EPSS 0.009
CVE-2026-32626
AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection
Published 2026-03-13 · Analyzed
9.6EPSS 0.007
CVE-2024-0550
Privileged User using traversal to read system files
Published 2024-02-28 · Analyzed
9.6EPSS 0.007
CVE-2024-0440
SSRF - file:// unsanitized access to underlying host files
Published 2024-02-25 · Analyzed
9.6EPSS 0.006
CVE-2024-0765
Default user role exporting save state of instance
Published 2024-03-03 · Analyzed
9.6EPSS 0.006
CVE-2024-3149
SSRF in mintplex-labs/anything-llm
Published 2024-06-06 · Modified
9.6EPSS 0.005
CVE-2024-3033
Improper Authorization in mintplex-labs/anything-llm
Published 2024-06-06 · Modified
9.4EPSS 0.006
CVE-2026-5627
Path Traversal in mintplex-labs/anything-llm
Published 2026-04-07 · Analyzed
9.1EPSS 0.011
CVE-2024-5211
Path Traversal to Arbitrary File Read/Delete/Overwrite, DoS Attack, and Admin Account Takeover in mintplex-labs/anything-llm
Published 2024-06-12 · Analyzed
9.1EPSS 0.010
CVE-2024-0404
Mass Assignment Vulnerability in mintplex-labs/anything-llm
Published 2024-04-16 · Analyzed
9.1EPSS 0.008
CVE-2023-5832
Improper Input Validation in mintplex-labs/anything-llm
Published 2023-10-30 · Modified
9.1EPSS 0.007
CVE-2024-3279
Improper Access Control in mintplex-labs/anything-llm
Published 2024-08-09 · Modified
9.1EPSS 0.006
CVE-2024-3029
Improper Input Validation in mintplex-labs/anything-llm
Published 2024-04-16 · Analyzed
9.0EPSS 0.007
CVE-2024-3150
Privilege Escalation in mintplex-labs/anything-llm
Published 2024-06-06 · Modified
8.8EPSS 0.008
CVE-2024-0439
User can manually send request at manager permission to modify system configurations
Published 2024-02-25 · Analyzed
8.8EPSS 0.006
CVE-2023-5833
Improper Access Control in mintplex-labs/anything-llm
Published 2023-10-30 · Modified
8.8EPSS 0.006
CVE-2024-3152
Privilege Escalation and Local File Inclusion in mintplex-labs/anything-llm
Published 2024-06-06 · Modified
8.8EPSS 0.006
CVE-2026-48116
AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill
Published 2026-05-28 · Modified
8.8EPSS 0.005
CVE-2026-32628
AnythingLLM has SQL Injection in Built-in SQL Agent Plugin via Unsanitized table_name Parameter
Published 2026-03-13 · Analyzed
8.8EPSS 0.004
CVE-2026-24477
AnythingLLM has key leak in `systemSettings.js`
Published 2026-01-26 · Analyzed
8.7EPSS 0.017
CVE-2024-3110
Stored XSS leading to admin account takeover in mintplex-labs/anything-llm
Published 2024-06-06 · Modified
8.7EPSS 0.007
CVE-2024-10109
Incorrect Authorization in mintplex-labs/anything-llm
Published 2025-03-20 · Analyzed
8.3EPSS 0.005
CVE-2024-0763
Improper validation of document removal parameter
Published 2024-02-27 · Modified
8.1EPSS 0.009
CVE-2024-0549
Relative Path Traversal in mintplex-labs/anything-llm
Published 2024-04-16 · Analyzed
8.1EPSS 0.008
CVE-2024-4287
Improper Input Validation in mintplex-labs/anything-llm
Published 2024-05-20 · Analyzed
8.1EPSS 0.006
CVE-2024-0798
Privilege Escalation in mintplex-labs/anything-llm
Published 2024-02-25 · Analyzed
8.1EPSS 0.006
CVE-2024-0435
User can submit message to self-XSS
Published 2024-02-25 · Analyzed
8.1EPSS 0.005
CVE-2024-0759
Collection of internally resolving IPs
Published 2024-02-27 · Analyzed
7.7EPSS 0.010
CVE-2024-4084
SSRF vulnerability in mintplex-labs/anything-llm
Published 2024-06-05 · Modified
7.7EPSS 0.005
CVE-2024-22422
Unauthenticated Denial of Service (DOS) attack in AnythingLLM
Published 2024-01-19 · Modified
7.5EPSS 0.010
CVE-2024-3569
Denial of Service (DoS) Vulnerability in mintplex-labs/anything-llm
Published 2024-04-10 · Analyzed
7.5EPSS 0.008
CVE-2024-8249
Unauthenticated Denial of Service (DoS) in mintplex-labs/anything-llm
Published 2025-03-20 · Analyzed
7.5EPSS 0.007
CVE-2024-5216
Denial of Service in mintplex-labs/anything-llm
Published 2024-06-25 · Analyzed
7.5EPSS 0.006
CVE-2026-32617
AnythingLLM Permissable CORS policy
Published 2026-03-13 · Analyzed
7.5EPSS 0.004
CVE-2024-7783
Improper Storage of Sensitive Information in Bearer Token in mintplex-labs/anything-llm
Published 2024-10-29 · Analyzed
7.5EPSS 0.003
CVE-2024-13059
Path Traversal in mintplex-labs/anything-llm
Published 2025-02-10 · Analyzed
7.2EPSS 0.213
CVE-2024-3283
Privilege Escalation via Mass Assignment in mintplex-labs/anything-llm
Published 2024-04-10 · Analyzed
7.2EPSS 0.010
1 / 2Next →