# cve.now: Mintplex-labs

The newest entries naming Mintplex-labs as an affected vendor (up to 200), of 77 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-88055](https://cve.now/CVE-2026-88055.md): AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator (CVSS 5.5)
- [CVE-2026-72917](https://cve.now/CVE-2026-72917.md): AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization (CVSS 5.9)
- [CVE-2026-55611](https://cve.now/CVE-2026-55611.md): AnythingLLM: embed-parsed-file cleanup deletes any parsed file by ID without ownership scoping (cross-tenant IDOR deletion) (CVSS 0.0)
- [CVE-2026-48789](https://cve.now/CVE-2026-48789.md): AnythingLLM: Windows path containment bypass in document folder route (CVSS 4.3)
- [CVE-2026-47713](https://cve.now/CVE-2026-47713.md): AnythingLLM: Legacy mobile device tokens bypass multi-user workspace scoping after mode migration (CVSS 2.0)
- [CVE-2026-48116](https://cve.now/CVE-2026-48116.md): AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill (CVSS 7.5)
- [CVE-2026-45403](https://cve.now/CVE-2026-45403.md): AnythingLLM: filesystem-copy-file follows nested symlinks and copies files from outside the allowed directory (CVSS 2.0)
- [CVE-2026-42456](https://cve.now/CVE-2026-42456.md): AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (IDOR) (CVSS 4.3)
- [CVE-2026-41318](https://cve.now/CVE-2026-41318.md): AnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable component (CVSS 5.4)
- [CVE-2026-5627](https://cve.now/CVE-2026-5627.md): Path Traversal in mintplex-labs/anything-llm (CVSS 9.1)
- [CVE-2026-32719](https://cve.now/CVE-2026-32719.md): AnythingLLM has a Zip Slip Path Traversal and Code Execution via Community Hub Plugin Import (CVSS 4.2)
- [CVE-2026-32717](https://cve.now/CVE-2026-32717.md): AnythingLLM access control bypass: suspended users can continue using Browser Extension API keys (CVSS 2.7)
- [CVE-2026-32715](https://cve.now/CVE-2026-32715.md): AnythingLLM Manager Privilege Bypass Allows Access to Admin-Only System Preferences (CVSS 3.8)
- [CVE-2026-32628](https://cve.now/CVE-2026-32628.md): AnythingLLM has SQL Injection in Built-in SQL Agent Plugin via Unsanitized table\_name Parameter (CVSS 7.7)
- [CVE-2026-32626](https://cve.now/CVE-2026-32626.md): AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection (CVSS 9.7)
- [CVE-2026-32617](https://cve.now/CVE-2026-32617.md): AnythingLLM Permissable CORS policy (CVSS 7.1)
- [CVE-2026-24478](https://cve.now/CVE-2026-24478.md): AnythingLLM vulnerable to Path Traversal (CVSS 7.2)
- [CVE-2026-24477](https://cve.now/CVE-2026-24477.md): AnythingLLM has key leak in \`systemSettings.js\` (CVSS 8.7)
- [CVE-2026-21484](https://cve.now/CVE-2026-21484.md): AnythingLLM Vulnerable to Username Enumeration w/ Password Recovery (CVSS 5.3)
- [CVE-2024-8196](https://cve.now/CVE-2024-8196.md): Missing Authentication for Critical Function in mintplex-labs/anything-llm (CVSS 9.8)
- [CVE-2024-8248](https://cve.now/CVE-2024-8248.md): Path Traversal in mintplex-labs/anything-llm (CVSS 7.2)
- [CVE-2024-6842](https://cve.now/CVE-2024-6842.md): Exposure of Sensitive Information in mintplex-labs/anything-llm (CVSS 7.5)
- [CVE-2024-10513](https://cve.now/CVE-2024-10513.md): Path Traversal in mintplex-labs/anything-llm (CVSS 7.2)
- [CVE-2024-8249](https://cve.now/CVE-2024-8249.md): Unauthenticated Denial of Service (DoS) in mintplex-labs/anything-llm (CVSS 7.5)
- [CVE-2024-10109](https://cve.now/CVE-2024-10109.md): Incorrect Authorization in mintplex-labs/anything-llm (CVSS 8.3)
- [CVE-2024-7771](https://cve.now/CVE-2024-7771.md): Denial of Service in mintplex-labs/anything-llm (CVSS 6.5)
- [CVE-2024-8251](https://cve.now/CVE-2024-8251.md): Prisma Injection in mintplex-labs/anything-llm (CVSS 5.3)
- [CVE-2024-13060](https://cve.now/CVE-2024-13060.md): Improper Authorization in mintplex-labs/anything-llm (CVSS 4.3)
- [CVE-2024-13059](https://cve.now/CVE-2024-13059.md): Path Traversal in mintplex-labs/anything-llm (CVSS 7.2)
- [CVE-2024-7783](https://cve.now/CVE-2024-7783.md): Improper Storage of Sensitive Information in Bearer Token in mintplex-labs/anything-llm (CVSS 5.9)
- [CVE-2024-3279](https://cve.now/CVE-2024-3279.md): Improper Access Control in mintplex-labs/anything-llm (CVSS 9.1)
- [CVE-2024-5216](https://cve.now/CVE-2024-5216.md): Denial of Service in mintplex-labs/anything-llm (CVSS 7.5)
- [CVE-2024-5213](https://cve.now/CVE-2024-5213.md): Exposure of Sensitive Information in mintplex-labs/anything-llm (CVSS 5.3)
- [CVE-2024-5208](https://cve.now/CVE-2024-5208.md): Uncontrolled Resource Consumption in mintplex-labs/anything-llm (CVSS 6.5)
- [CVE-2024-5211](https://cve.now/CVE-2024-5211.md): Path Traversal to Arbitrary File Read/Delete/Overwrite, DoS Attack, and Admin Account Takeover in mintplex-labs/anything-llm (CVSS 9.1)
- [CVE-2024-3150](https://cve.now/CVE-2024-3150.md): Privilege Escalation in mintplex-labs/anything-llm (CVSS 8.1)
- [CVE-2024-3149](https://cve.now/CVE-2024-3149.md): SSRF in mintplex-labs/anything-llm (CVSS 9.6)
- [CVE-2024-3153](https://cve.now/CVE-2024-3153.md): Uncontrolled Resource Consumption in mintplex-labs/anything-llm (CVSS 6.5)
- [CVE-2024-3166](https://cve.now/CVE-2024-3166.md): Cross-Site Scripting (XSS) Vulnerability in mintplex-labs/anything-llm (CVSS 3.4)
- [CVE-2024-3102](https://cve.now/CVE-2024-3102.md): JSON Injection in mintplex-labs/anything-llm (CVSS 5.3)
- [CVE-2024-3110](https://cve.now/CVE-2024-3110.md): Stored XSS leading to admin account takeover in mintplex-labs/anything-llm (CVSS 7.3)
- [CVE-2024-3104](https://cve.now/CVE-2024-3104.md): Remote Code Execution in mintplex-labs/anything-llm (CVSS 9.6)
- [CVE-2024-3033](https://cve.now/CVE-2024-3033.md): Improper Authorization in mintplex-labs/anything-llm (CVSS 9.1)
- [CVE-2024-3152](https://cve.now/CVE-2024-3152.md): Privilege Escalation and Local File Inclusion in mintplex-labs/anything-llm (CVSS 8.8)
- [CVE-2024-4084](https://cve.now/CVE-2024-4084.md): SSRF vulnerability in mintplex-labs/anything-llm (CVSS 7.7)
- [CVE-2024-4286](https://cve.now/CVE-2024-4286.md): Improper Neutralization of Special Elements in mintplex-labs/anything-llm (CVSS 4.9)
- [CVE-2024-4287](https://cve.now/CVE-2024-4287.md): Improper Input Validation in mintplex-labs/anything-llm (CVSS 8.1)
- [CVE-2024-4284](https://cve.now/CVE-2024-4284.md): Denial of Service in mintplex-labs/anything-llm (CVSS 4.9)
- [CVE-2024-2913](https://cve.now/CVE-2024-2913.md): Race Condition Vulnerability in mintplex-labs/anything-llm (CVSS 6.5)
- [CVE-2024-3029](https://cve.now/CVE-2024-3029.md): Improper Input Validation in mintplex-labs/anything-llm (CVSS 9.0)
- [CVE-2024-0549](https://cve.now/CVE-2024-0549.md): Relative Path Traversal in mintplex-labs/anything-llm (CVSS 8.1)
- [CVE-2024-3028](https://cve.now/CVE-2024-3028.md): Improper Input Validation in mintplex-labs/anything-llm (CVSS 7.2)
- [CVE-2024-0404](https://cve.now/CVE-2024-0404.md): Mass Assignment Vulnerability in mintplex-labs/anything-llm (CVSS 9.1)
- [CVE-2024-3570](https://cve.now/CVE-2024-3570.md): Stored XSS leading to Admin Account Takeover in mintplex-labs/anything-llm (CVSS 0.0)
- [CVE-2024-3101](https://cve.now/CVE-2024-3101.md): Privilege Escalation via Improper Input Validation in mintplex-labs/anything-llm (CVSS 6.7)
- [CVE-2024-3283](https://cve.now/CVE-2024-3283.md): Privilege Escalation via Mass Assignment in mintplex-labs/anything-llm (CVSS 7.2)
- [CVE-2024-3569](https://cve.now/CVE-2024-3569.md): Denial of Service (DoS) Vulnerability in mintplex-labs/anything-llm (CVSS 7.5)
- [CVE-2024-3025](https://cve.now/CVE-2024-3025.md): Path Traversal in mintplex-labs/anything-llm (CVSS 9.9)
- [CVE-2024-0765](https://cve.now/CVE-2024-0765.md): Default user role exporting save state of instance (CVSS 9.6)
- [CVE-2024-0795](https://cve.now/CVE-2024-0795.md): Create user API role not enforced (CVSS 7.2)
- [CVE-2024-0550](https://cve.now/CVE-2024-0550.md): Privileged User using traversal to read system files (CVSS 9.6)
- [CVE-2024-0763](https://cve.now/CVE-2024-0763.md): Improper validation of document removal parameter (CVSS 8.1)
- [CVE-2024-0551](https://cve.now/CVE-2024-0551.md): Download and export of file via default user role (CVSS 7.1)
- [CVE-2024-0759](https://cve.now/CVE-2024-0759.md): Collection of internally resolving IPs (CVSS 7.7)
- [CVE-2024-0439](https://cve.now/CVE-2024-0439.md): User can manually send request at manager permission to modify system configurations (CVSS 7.1)
- [CVE-2024-0440](https://cve.now/CVE-2024-0440.md): SSRF - file:// unsanitized access to underlying host files (CVSS 9.6)
- [CVE-2024-0435](https://cve.now/CVE-2024-0435.md): User can submit message to self-XSS (CVSS 8.1)
- [CVE-2024-0798](https://cve.now/CVE-2024-0798.md): Privilege Escalation in mintplex-labs/anything-llm (CVSS 8.1)
- [CVE-2024-0436](https://cve.now/CVE-2024-0436.md): Prevent timing attack for single-user password check (CVSS 7.1)
- [CVE-2024-0455](https://cve.now/CVE-2024-0455.md): SSRF on AWS deployed instances of AnythingLLM via /metadata (CVSS 9.9)
- [CVE-2024-0879](https://cve.now/CVE-2024-0879.md): Authentication bypass in vector-admin domain restriction (CVSS 6.5)
- [CVE-2024-22422](https://cve.now/CVE-2024-22422.md): Unauthenticated Denial of Service (DOS) attack in AnythingLLM (CVSS 7.5)
- [CVE-2023-5833](https://cve.now/CVE-2023-5833.md): Improper Access Control in mintplex-labs/anything-llm (CVSS 8.1)
- [CVE-2023-5832](https://cve.now/CVE-2023-5832.md): Improper Input Validation in mintplex-labs/anything-llm (CVSS 9.1)
- [CVE-2023-4899](https://cve.now/CVE-2023-4899.md): SQL Injection in mintplex-labs/anything-llm (CVSS 8.1)
- [CVE-2023-4898](https://cve.now/CVE-2023-4898.md): Authentication Bypass by Primary Weakness in mintplex-labs/anything-llm (CVSS 8.2)
- [CVE-2023-4897](https://cve.now/CVE-2023-4897.md): Relative Path Traversal in mintplex-labs/anything-llm (CVSS 8.7)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/mintplex-labs
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.