MI
Vendor
mintplex-labs
77
CVEs
0
On KEV
0
New 30D
Products
MI9.9
mintplex-labs/anything-llm
mintplex-labs
57 CVEs0 on KEV0 new
AN9.6
anything-llm
Mintplex-Labs
19 CVEs0 on KEV0 new
VE4.3
vector-admin
Mintplex-Labs
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-88055 | AN anything-llm Mintplex-Labs | 5.5 | Sep 10 | AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator |
| CVE-2026-72917 | AN anything-llm Mintplex-Labs | 5.9 | Aug 10 | AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization |
| CVE-2026-55611 | AN anything-llm Mintplex-Labs | 0.0 | Jun 24 | AnythingLLM: embed-parsed-file cleanup deletes any parsed file by ID without ownership scoping (cross-tenant IDOR deletion) |
| CVE-2026-48789 | AN anything-llm Mintplex-Labs | 4.3 | Jun 24 | AnythingLLM: Windows path containment bypass in document folder route |
| CVE-2026-47713 | AN anything-llm Mintplex-Labs | 4.3 | May 28 | AnythingLLM: Legacy mobile device tokens bypass multi-user workspace scoping after mode migration |
| CVE-2026-48116 | AN anything-llm Mintplex-Labs | 8.8 | May 28 | AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill |
| CVE-2026-45403 | AN anything-llm Mintplex-Labs | 2.5 | May 28 | AnythingLLM: filesystem-copy-file follows nested symlinks and copies files from outside the allowed directory |
| CVE-2026-42456 | AN anything-llm Mintplex-Labs | 4.3 | May 8 | AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (IDOR) |
| CVE-2026-41318 | AN anything-llm Mintplex-Labs | 5.4 | Apr 24 | AnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable component |
| CVE-2026-5627 | MI mintplex-labs/anything-llm mintplex-labs | 7.2 | Apr 7 | Path Traversal in mintplex-labs/anything-llm |
| CVE-2026-32719 | AN anything-llm Mintplex-Labs | 6.4 | Mar 13 | AnythingLLM has a Zip Slip Path Traversal and Code Execution via Community Hub Plugin Import |
| CVE-2026-32717 | AN anything-llm Mintplex-Labs | 2.7 | Mar 13 | AnythingLLM access control bypass: suspended users can continue using Browser Extension API keys |
| CVE-2026-32715 | AN anything-llm Mintplex-Labs | 3.8 | Mar 13 | AnythingLLM Manager Privilege Bypass Allows Access to Admin-Only System Preferences |
| CVE-2026-32628 | AN anything-llm Mintplex-Labs | 8.8 | Mar 13 | AnythingLLM has SQL Injection in Built-in SQL Agent Plugin via Unsanitized table_name Parameter |
| CVE-2026-32626 | AN anything-llm Mintplex-Labs | 9.6 | Mar 13 | AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection |
| CVE-2026-32617 | AN anything-llm Mintplex-Labs | 7.5 | Mar 13 | AnythingLLM Permissable CORS policy |
| CVE-2026-24478 | AN anything-llm Mintplex-Labs | 7.2 | Jan 26 | AnythingLLM vulnerable to Path Traversal |
| CVE-2026-24477 | AN anything-llm Mintplex-Labs | 7.5 | Jan 26 | AnythingLLM has key leak in `systemSettings.js` |
| CVE-2026-21484 | AN anything-llm Mintplex-Labs | 5.3 | Jan 3 | AnythingLLM Vulnerable to Username Enumeration w/ Password Recovery |
| CVE-2024-8196 | MI mintplex-labs/anything-llm mintplex-labs | 9.8 | Mar 20 | Missing Authentication for Critical Function in mintplex-labs/anything-llm |
| CVE-2024-8248 | MI mintplex-labs/anything-llm mintplex-labs | 7.2 | Mar 20 | Path Traversal in mintplex-labs/anything-llm |
| CVE-2024-6842 | MI mintplex-labs/anything-llm mintplex-labs | 7.5 | Mar 20 | Exposure of Sensitive Information in mintplex-labs/anything-llm |
| CVE-2024-10513 | MI mintplex-labs/anything-llm mintplex-labs | 7.2 | Mar 20 | Path Traversal in mintplex-labs/anything-llm |
| CVE-2024-8249 | MI mintplex-labs/anything-llm mintplex-labs | 7.5 | Mar 20 | Unauthenticated Denial of Service (DoS) in mintplex-labs/anything-llm |
| CVE-2024-10109 | MI mintplex-labs/anything-llm mintplex-labs | 8.3 | Mar 20 | Incorrect Authorization in mintplex-labs/anything-llm |
| CVE-2024-7771 | MI mintplex-labs/anything-llm mintplex-labs | 6.5 | Mar 20 | Denial of Service in mintplex-labs/anything-llm |
| CVE-2024-8251 | MI mintplex-labs/anything-llm mintplex-labs | 5.3 | Mar 20 | Prisma Injection in mintplex-labs/anything-llm |
| CVE-2024-13060 | MI mintplex-labs/anything-llm mintplex-labs | 4.3 | Mar 20 | Improper Authorization in mintplex-labs/anything-llm |
| CVE-2024-13059 | MI mintplex-labs/anything-llm mintplex-labs | 7.2 | Feb 10 | Path Traversal in mintplex-labs/anything-llm |
| CVE-2024-7783 | MI mintplex-labs/anything-llm mintplex-labs | 7.5 | Oct 29 | Improper Storage of Sensitive Information in Bearer Token in mintplex-labs/anything-llm |
| CVE-2024-3279 | MI mintplex-labs/anything-llm mintplex-labs | 9.1 | Aug 9 | Improper Access Control in mintplex-labs/anything-llm |
| CVE-2024-5216 | MI mintplex-labs/anything-llm mintplex-labs | 7.5 | Jun 25 | Denial of Service in mintplex-labs/anything-llm |
| CVE-2024-5213 | MI mintplex-labs/anything-llm mintplex-labs | 6.5 | Jun 20 | Exposure of Sensitive Information in mintplex-labs/anything-llm |
| CVE-2024-5208 | MI mintplex-labs/anything-llm mintplex-labs | 6.5 | Jun 19 | Uncontrolled Resource Consumption in mintplex-labs/anything-llm |
| CVE-2024-5211 | MI mintplex-labs/anything-llm mintplex-labs | 7.2 | Jun 12 | Path Traversal to Arbitrary File Read/Delete/Overwrite, DoS Attack, and Admin Account Takeover in mintplex-labs/anything-llm |
| CVE-2024-3150 | MI mintplex-labs/anything-llm mintplex-labs | 8.8 | Jun 6 | Privilege Escalation in mintplex-labs/anything-llm |
| CVE-2024-3149 | MI mintplex-labs/anything-llm mintplex-labs | 8.8 | Jun 6 | SSRF in mintplex-labs/anything-llm |
| CVE-2024-3153 | MI mintplex-labs/anything-llm mintplex-labs | 6.5 | Jun 6 | Uncontrolled Resource Consumption in mintplex-labs/anything-llm |
| CVE-2024-3166 | MI mintplex-labs/anything-llm mintplex-labs | 9.6 | Jun 6 | Cross-Site Scripting (XSS) Vulnerability in mintplex-labs/anything-llm |
| CVE-2024-3102 | MI mintplex-labs/anything-llm mintplex-labs | 5.3 | Jun 6 | JSON Injection in mintplex-labs/anything-llm |
| CVE-2024-3110 | MI mintplex-labs/anything-llm mintplex-labs | 8.7 | Jun 6 | Stored XSS leading to admin account takeover in mintplex-labs/anything-llm |
| CVE-2024-3104 | MI mintplex-labs/anything-llm mintplex-labs | 9.8 | Jun 6 | Remote Code Execution in mintplex-labs/anything-llm |
| CVE-2024-3033 | MI mintplex-labs/anything-llm mintplex-labs | 9.4 | Jun 6 | Improper Authorization in mintplex-labs/anything-llm |
| CVE-2024-3152 | MI mintplex-labs/anything-llm mintplex-labs | 8.8 | Jun 6 | Privilege Escalation and Local File Inclusion in mintplex-labs/anything-llm |
| CVE-2024-4084 | MI mintplex-labs/anything-llm mintplex-labs | 7.5 | Jun 5 | SSRF vulnerability in mintplex-labs/anything-llm |
| CVE-2024-4286 | MI mintplex-labs/anything-llm mintplex-labs | 4.9 | May 26 | Improper Neutralization of Special Elements in mintplex-labs/anything-llm |
| CVE-2024-4287 | MI mintplex-labs/anything-llm mintplex-labs | 7.2 | May 20 | Improper Input Validation in mintplex-labs/anything-llm |
| CVE-2024-4284 | MI mintplex-labs/anything-llm mintplex-labs | 4.9 | May 19 | Denial of Service in mintplex-labs/anything-llm |
| CVE-2024-2913 | MI mintplex-labs/anything-llm mintplex-labs | 6.5 | May 6 | Race Condition Vulnerability in mintplex-labs/anything-llm |
| CVE-2024-3029 | MI mintplex-labs/anything-llm mintplex-labs | 8.0 | Apr 16 | Improper Input Validation in mintplex-labs/anything-llm |
| CVE-2024-0549 | MI mintplex-labs/anything-llm mintplex-labs | 8.1 | Apr 16 | Relative Path Traversal in mintplex-labs/anything-llm |
| CVE-2024-3028 | MI mintplex-labs/anything-llm mintplex-labs | 7.2 | Apr 16 | Improper Input Validation in mintplex-labs/anything-llm |
| CVE-2024-0404 | MI mintplex-labs/anything-llm mintplex-labs | 9.1 | Apr 16 | Mass Assignment Vulnerability in mintplex-labs/anything-llm |
| CVE-2024-3570 | MI mintplex-labs/anything-llm mintplex-labs | 5.4 | Apr 10 | Stored XSS leading to Admin Account Takeover in mintplex-labs/anything-llm |
| CVE-2024-3101 | MI mintplex-labs/anything-llm mintplex-labs | 7.2 | Apr 10 | Privilege Escalation via Improper Input Validation in mintplex-labs/anything-llm |
| CVE-2024-3283 | MI mintplex-labs/anything-llm mintplex-labs | 7.2 | Apr 10 | Privilege Escalation via Mass Assignment in mintplex-labs/anything-llm |
| CVE-2024-3569 | MI mintplex-labs/anything-llm mintplex-labs | 7.5 | Apr 10 | Denial of Service (DoS) Vulnerability in mintplex-labs/anything-llm |
| CVE-2024-3025 | MI mintplex-labs/anything-llm mintplex-labs | 9.9 | Apr 10 | Path Traversal in mintplex-labs/anything-llm |
| CVE-2024-0765 | MI mintplex-labs/anything-llm mintplex-labs | 6.5 | Mar 3 | Default user role exporting save state of instance |
| CVE-2024-0795 | MI mintplex-labs/anything-llm mintplex-labs | 7.2 | Mar 2 | Create user API role not enforced |