# Mintplex-Labs anything-llm. Every CVE that names Mintplex-Labs anything-llm among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator](https://agentprime.io/advisories/CVE-2026-88055.md) `CVE-2026-88055` · CVE record: Mintplex-Labs anything-llm · CVSS 5.5 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS) - [AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization](https://agentprime.io/advisories/CVE-2026-72917.md) `CVE-2026-72917` · CVE record: Mintplex-Labs anything-llm · CVSS 5.9 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Authentication bypass, CWE-180 - [AnythingLLM: embed-parsed-file cleanup deletes any parsed file by ID without ownership scoping (cross-tenant IDOR deletion)](https://agentprime.io/advisories/CVE-2026-55611.md) `CVE-2026-55611` · CVE record: Mintplex-Labs anything-llm · CVSS 0.0 None · Not analysed yet · Published 24 Jun 2026 · Tags: Broken access control - [AnythingLLM: Windows path containment bypass in document folder route](https://agentprime.io/advisories/CVE-2026-48789.md) `CVE-2026-48789` · CVE record: Mintplex-Labs anything-llm · CVSS 4.3 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Path traversal - [AnythingLLM: Legacy mobile device tokens bypass multi-user workspace scoping after mode migration](https://agentprime.io/advisories/CVE-2026-47713.md) `CVE-2026-47713` · CVE record: Mintplex-Labs anything-llm · CVSS 2.0 Low · Not analysed yet · Published 28 May 2026 · Tags: Broken access control - [AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill](https://agentprime.io/advisories/CVE-2026-48116.md) `CVE-2026-48116` · CVE record: Mintplex-Labs anything-llm · CVSS 7.5 High · Not analysed yet · Published 28 May 2026 · Tags: Command injection - [AnythingLLM: filesystem-copy-file follows nested symlinks and copies files from outside the allowed directory](https://agentprime.io/advisories/CVE-2026-45403.md) `CVE-2026-45403` · CVE record: Mintplex-Labs anything-llm · CVSS 2.0 Low · Not analysed yet · Published 28 May 2026 · Tags: Path traversal - [AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (IDOR)](https://agentprime.io/advisories/CVE-2026-42456.md) `CVE-2026-42456` · CVE record: Mintplex-Labs anything-llm · CVSS 4.3 Medium · Not analysed yet · Published 8 May 2026 · Tags: Information disclosure, Broken access control - [AnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable component](https://agentprime.io/advisories/CVE-2026-41318.md) `CVE-2026-41318` · CVE record: Mintplex-Labs anything-llm · CVSS 5.4 Medium · Not analysed yet · Published 24 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection, CWE-116 - [Path Traversal in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2026-5627.md) `CVE-2026-5627` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Apr 2026 · Tags: CWE-29 - [AnythingLLM has a Zip Slip Path Traversal and Code Execution via Community Hub Plugin Import](https://agentprime.io/advisories/CVE-2026-32719.md) `CVE-2026-32719` · CVE record: Mintplex-Labs anything-llm · CVSS 4.2 Medium · Not analysed yet · Published 13 Mar 2026 · Tags: Path traversal, Code injection - [AnythingLLM access control bypass: suspended users can continue using Browser Extension API keys](https://agentprime.io/advisories/CVE-2026-32717.md) `CVE-2026-32717` · CVE record: Mintplex-Labs anything-llm · CVSS 2.7 Low · Not analysed yet · Published 13 Mar 2026 · Tags: Broken access control - [AnythingLLM Manager Privilege Bypass Allows Access to Admin-Only System Preferences](https://agentprime.io/advisories/CVE-2026-32715.md) `CVE-2026-32715` · CVE record: Mintplex-Labs anything-llm · CVSS 3.8 Low · Not analysed yet · Published 13 Mar 2026 · Tags: Broken access control - [AnythingLLM has SQL Injection in Built-in SQL Agent Plugin via Unsanitized table_name Parameter](https://agentprime.io/advisories/CVE-2026-32628.md) `CVE-2026-32628` · CVE record: Mintplex-Labs anything-llm · CVSS 7.7 High · Not analysed yet · Published 13 Mar 2026 · Tags: SQL injection - [AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection](https://agentprime.io/advisories/CVE-2026-32626.md) `CVE-2026-32626` · CVE record: Mintplex-Labs anything-llm · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Mar 2026 · Tags: Cross-site scripting (XSS) - [AnythingLLM Permissable CORS policy](https://agentprime.io/advisories/CVE-2026-32617.md) `CVE-2026-32617` · CVE record: Mintplex-Labs anything-llm · CVSS 7.1 High · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-942, CWE-1188 - [AnythingLLM vulnerable to Path Traversal](https://agentprime.io/advisories/CVE-2026-24478.md) `CVE-2026-24478` · CVE record: Mintplex-Labs anything-llm · CVSS 7.2 High · Not analysed yet · Published 26 Jan 2026 · Tags: Path traversal - [AnythingLLM has key leak in \`systemSettings.js\`](https://agentprime.io/advisories/CVE-2026-24477.md) `CVE-2026-24477` · CVE record: Mintplex-Labs anything-llm · CVSS 8.7 High · Not analysed yet · Published 26 Jan 2026 · Tags: Information disclosure - [AnythingLLM Vulnerable to Username Enumeration w/ Password Recovery](https://agentprime.io/advisories/CVE-2026-21484.md) `CVE-2026-21484` · CVE record: Mintplex-Labs anything-llm · CVSS 5.3 Medium · Not analysed yet · Published 3 Jan 2026 · Tags: Information disclosure, CWE-204 - [Missing Authentication for Critical Function in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-8196.md) `CVE-2024-8196` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Mar 2025 · Tags: Authentication bypass - [Path Traversal in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-8248.md) `CVE-2024-8248` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 7.2 High · Not analysed yet · Published 20 Mar 2025 · Tags: CWE-29 - [Exposure of Sensitive Information in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-6842.md) `CVE-2024-6842` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.36 · Not analysed yet · Published 20 Mar 2025 · Tags: Authentication bypass - [Path Traversal in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-10513.md) `CVE-2024-10513` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 7.2 High · Not analysed yet · Published 20 Mar 2025 · Tags: Path traversal - [Unauthenticated Denial of Service (DoS) in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-8249.md) `CVE-2024-8249` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 7.5 High · Not analysed yet · Published 20 Mar 2025 · Tags: CWE-248 - [Incorrect Authorization in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-10109.md) `CVE-2024-10109` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 8.3 High · Not analysed yet · Published 20 Mar 2025 · Tags: Broken access control - [Denial of Service in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-7771.md) `CVE-2024-7771` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 6.5 Medium · Not analysed yet · Published 20 Mar 2025 · Tags: Denial of service - [Prisma Injection in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-8251.md) `CVE-2024-8251` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 5.3 Medium · Not analysed yet · Published 20 Mar 2025 · Tags: SQL injection - [Improper Authorization in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-13060.md) `CVE-2024-13060` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 4.3 Medium · Not analysed yet · Published 20 Mar 2025 · Tags: Broken access control - [Path Traversal in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-13059.md) `CVE-2024-13059` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 7.2 High · Critical (CVSS 7+ and EPSS) · EPSS 0.24 · Not analysed yet · Published 10 Feb 2025 · Tags: CWE-29 - [Improper Storage of Sensitive Information in Bearer Token in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-7783.md) `CVE-2024-7783` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 5.9 Medium · Not analysed yet · Published 29 Oct 2024 · Tags: Information disclosure - [Improper Access Control in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-3279.md) `CVE-2024-3279` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Aug 2024 · Tags: Authentication bypass - [Denial of Service in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-5216.md) `CVE-2024-5216` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 7.5 High · Not analysed yet · Published 25 Jun 2024 · Tags: Denial of service - [Exposure of Sensitive Information in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-5213.md) `CVE-2024-5213` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 5.3 Medium · Not analysed yet · Published 20 Jun 2024 · Tags: Information disclosure - [Uncontrolled Resource Consumption in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-5208.md) `CVE-2024-5208` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 6.5 Medium · Not analysed yet · Published 19 Jun 2024 · Tags: Denial of service - [Path Traversal to Arbitrary File Read/Delete/Overwrite, DoS Attack, and Admin Account Takeover in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-5211.md) `CVE-2024-5211` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Jun 2024 · Tags: CWE-29 - [Privilege Escalation in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-3150.md) `CVE-2024-3150` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 8.1 High · Not analysed yet · Published 6 Jun 2024 · Tags: CWE-755 - [SSRF in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-3149.md) `CVE-2024-3149` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jun 2024 · Tags: Server-side request forgery (SSRF) - [Uncontrolled Resource Consumption in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-3153.md) `CVE-2024-3153` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 6.5 Medium · Not analysed yet · Published 6 Jun 2024 · Tags: Denial of service - [Cross-Site Scripting (XSS) Vulnerability in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-3166.md) `CVE-2024-3166` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 3.4 Low · Not analysed yet · Published 6 Jun 2024 · Tags: Cross-site scripting (XSS) - [JSON Injection in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-3102.md) `CVE-2024-3102` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 5.3 Medium · Not analysed yet · Published 6 Jun 2024 · Tags: Authentication bypass - [Stored XSS leading to admin account takeover in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-3110.md) `CVE-2024-3110` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 7.3 High · Not analysed yet · Published 6 Jun 2024 · Tags: Cross-site scripting (XSS) - [Remote Code Execution in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-3104.md) `CVE-2024-3104` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jun 2024 · Tags: Command injection - [Improper Authorization in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-3033.md) `CVE-2024-3033` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jun 2024 · Tags: Broken access control - [Privilege Escalation and Local File Inclusion in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-3152.md) `CVE-2024-3152` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 8.8 High · Not analysed yet · Published 6 Jun 2024 · Tags: Server-side request forgery (SSRF) - [SSRF vulnerability in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-4084.md) `CVE-2024-4084` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 7.7 High · Not analysed yet · Published 5 Jun 2024 · Tags: Server-side request forgery (SSRF) - [Improper Neutralization of Special Elements in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-4286.md) `CVE-2024-4286` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 4.9 Medium · Not analysed yet · Published 26 May 2024 · Tags: Code injection - [Improper Input Validation in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-4287.md) `CVE-2024-4287` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 8.1 High · Not analysed yet · Published 20 May 2024 · Tags: CWE-20 - [Denial of Service in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-4284.md) `CVE-2024-4284` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 4.9 Medium · Not analysed yet · Published 19 May 2024 · Tags: Denial of service - [Race Condition Vulnerability in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-2913.md) `CVE-2024-2913` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 6.5 Medium · Not analysed yet · Published 6 May 2024 · Tags: Race condition - [Improper Input Validation in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-3029.md) `CVE-2024-3029` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Apr 2024 · Tags: CWE-20 - [Relative Path Traversal in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-0549.md) `CVE-2024-0549` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 8.1 High · Not analysed yet · Published 16 Apr 2024 · Tags: Path traversal - [Improper Input Validation in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-3028.md) `CVE-2024-3028` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 7.2 High · Not analysed yet · Published 16 Apr 2024 · Tags: CWE-20 - [Mass Assignment Vulnerability in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-0404.md) `CVE-2024-0404` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Apr 2024 · Tags: Broken access control - [Stored XSS leading to Admin Account Takeover in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-3570.md) `CVE-2024-3570` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 0.0 None · Not analysed yet · Published 10 Apr 2024 · Tags: Cross-site scripting (XSS) - [Privilege Escalation via Improper Input Validation in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-3101.md) `CVE-2024-3101` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 6.7 Medium · Not analysed yet · Published 10 Apr 2024 · Tags: CWE-20 - [Privilege Escalation via Mass Assignment in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-3283.md) `CVE-2024-3283` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 7.2 High · Not analysed yet · Published 10 Apr 2024 · Tags: Broken access control - [Denial of Service (DoS) Vulnerability in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-3569.md) `CVE-2024-3569` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 7.5 High · Not analysed yet · Published 10 Apr 2024 · Tags: Denial of service - [Path Traversal in mintplex-labs/anything-llm](https://agentprime.io/advisories/CVE-2024-3025.md) `CVE-2024-3025` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Apr 2024 · Tags: Path traversal - [Default user role exporting save state of instance](https://agentprime.io/advisories/CVE-2024-0765.md) `CVE-2024-0765` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Mar 2024 · Tags: Information disclosure - [Create user API role not enforced](https://agentprime.io/advisories/CVE-2024-0795.md) `CVE-2024-0795` · CVE record: mintplex-labs mintplex-labs/anything-llm · CVSS 7.2 High · Not analysed yet · Published 2 Mar 2024 · Tags: Broken access control Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .