CVE-2026-88055AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator Exploitation status Public exploit Fix Not confirmed Affected product A anything-llm Published 09/10/2026 Severity Medium CVE-2026-72917AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization Exploitation status Not known exploited Fix Not confirmed Affected product A anything-llm Published 08/10/2026 Severity Medium CVE-2026-55611AnythingLLM: embed-parsed-file cleanup deletes any parsed file by ID without ownership scoping (cross-tenant IDOR deletion) Exploitation status Public exploit Fix Affected product A anything-llm Published 06/24/2026 Severity Informational CVE-2026-48789AnythingLLM: Windows path containment bypass in document folder route Exploitation status Not known exploited Fix Affected product A anything-llm Published 06/24/2026 Severity Medium CVE-2026-47713AnythingLLM: Legacy mobile device tokens bypass multi-user workspace scoping after mode migration Exploitation status Public exploit Fix Affected product A anything-llm Published 05/28/2026 Severity Low CVE-2026-48116AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill Exploitation status Public exploit Fix Affected product A anything-llm Published 05/28/2026 Severity High CVE-2026-45403AnythingLLM: filesystem-copy-file follows nested symlinks and copies files from outside the allowed directory Exploitation status Public exploit Fix Affected product A anything-llm Published 05/28/2026 Severity Low CVE-2026-42456AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (IDOR) Exploitation status Public exploit Fix Affected product A anything-llm Published 05/08/2026 Severity Medium CVE-2026-41318AnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable component Exploitation status Public exploit Fix Not confirmed Affected product A anything-llm Published 04/24/2026 Severity Medium CVE-2026-5627Path Traversal in mintplex-labs/anything-llm Exploitation status Not known exploited Fix Affected product M mintplex-labs/anything-llm Published 04/07/2026 Severity Critical CVE-2026-32719AnythingLLM has a Zip Slip Path Traversal and Code Execution via Community Hub Plugin Import Exploitation status Not known exploited Fix Not confirmed Affected product A anything-llm Published 03/13/2026 Severity Medium CVE-2026-32717AnythingLLM access control bypass: suspended users can continue using Browser Extension API keys Exploitation status Public exploit Fix Not confirmed Affected product A anything-llm Published 03/13/2026 Severity Low CVE-2026-32715AnythingLLM Manager Privilege Bypass Allows Access to Admin-Only System Preferences Exploitation status Public exploit Fix Not confirmed Affected product A anything-llm Published 03/13/2026 Severity Low CVE-2026-32628AnythingLLM has SQL Injection in Built-in SQL Agent Plugin via Unsanitized table_name Parameter Exploitation status Not known exploited Fix Not confirmed Affected product A anything-llm Published 03/13/2026 Severity High CVE-2026-32626AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection Exploitation status Not known exploited Fix Not confirmed Affected product A anything-llm Published 03/13/2026 Severity Critical CVE-2026-32617AnythingLLM Permissable CORS policy Exploitation status Public exploit Fix Not confirmed Affected product A anything-llm Published 03/13/2026 Severity High CVE-2026-24478AnythingLLM vulnerable to Path Traversal Exploitation status Public exploit Fix Not confirmed Affected product A anything-llm Published 01/26/2026 Severity High CVE-2026-24477AnythingLLM has key leak in `systemSettings.js` Exploitation status Public exploit Fix Not confirmed Affected product A anything-llm Published 01/26/2026 Severity High CVE-2026-21484AnythingLLM Vulnerable to Username Enumeration w/ Password Recovery Exploitation status Not known exploited Fix Not confirmed Affected product A anything-llm Published 01/03/2026 Severity Medium CVE-2024-8196Missing Authentication for Critical Function in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 03/20/2025 Severity Critical CVE-2024-8248Path Traversal in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 03/20/2025 Severity High CVE-2024-6842Exposure of Sensitive Information in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 03/20/2025 Severity High CVE-2024-10513Path Traversal in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 03/20/2025 Severity High CVE-2024-8249Unauthenticated Denial of Service (DoS) in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 03/20/2025 Severity High CVE-2024-10109Incorrect Authorization in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 03/20/2025 Severity High CVE-2024-7771Denial of Service in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 03/20/2025 Severity Medium CVE-2024-8251Prisma Injection in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 03/20/2025 Severity Medium CVE-2024-13060Improper Authorization in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 03/20/2025 Severity Medium CVE-2024-13059Path Traversal in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 02/10/2025 Severity High CVE-2024-7783Improper Storage of Sensitive Information in Bearer Token in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 10/29/2024 Severity Medium CVE-2024-3279Improper Access Control in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 08/09/2024 Severity Critical CVE-2024-5216Denial of Service in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 06/25/2024 Severity High CVE-2024-5213Exposure of Sensitive Information in mintplex-labs/anything-llm Exploitation status Not known exploited Fix Affected product M mintplex-labs/anything-llm Published 06/20/2024 Severity Medium CVE-2024-5208Uncontrolled Resource Consumption in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 06/19/2024 Severity Medium CVE-2024-5211Path Traversal to Arbitrary File Read/Delete/Overwrite, DoS Attack, and Admin Account Takeover in mintplex-labs/anything-llm Exploitation status Not known exploited Fix Affected product M mintplex-labs/anything-llm Published 06/12/2024 Severity Critical CVE-2024-3150Privilege Escalation in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 06/06/2024 Severity High CVE-2024-3149SSRF in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 06/06/2024 Severity Critical CVE-2024-3153Uncontrolled Resource Consumption in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 06/06/2024 Severity Medium CVE-2024-3166Cross-Site Scripting (XSS) Vulnerability in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 06/06/2024 Severity Low CVE-2024-3102JSON Injection in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 06/06/2024 Severity Medium CVE-2024-3110Stored XSS leading to admin account takeover in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 06/06/2024 Severity High CVE-2024-3104Remote Code Execution in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 06/06/2024 Severity Critical CVE-2024-3033Improper Authorization in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 06/06/2024 Severity Critical CVE-2024-3152Privilege Escalation and Local File Inclusion in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 06/06/2024 Severity High CVE-2024-4084SSRF vulnerability in mintplex-labs/anything-llm Exploitation status Public exploit Fix Not confirmed Affected product M mintplex-labs/anything-llm Published 06/05/2024 Severity High CVE-2024-4286Improper Neutralization of Special Elements in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 05/26/2024 Severity Medium CVE-2024-4287Improper Input Validation in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 05/20/2024 Severity High CVE-2024-4284Denial of Service in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 05/19/2024 Severity Medium CVE-2024-2913Race Condition Vulnerability in mintplex-labs/anything-llm Exploitation status Not known exploited Fix Not confirmed Affected product M mintplex-labs/anything-llm Published 05/06/2024 Severity Medium CVE-2024-3029Improper Input Validation in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 04/16/2024 Severity Critical CVE-2024-0549Relative Path Traversal in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 04/16/2024 Severity High CVE-2024-3028Improper Input Validation in mintplex-labs/anything-llm Exploitation status Not known exploited Fix Affected product M mintplex-labs/anything-llm Published 04/16/2024 Severity High CVE-2024-0404Mass Assignment Vulnerability in mintplex-labs/anything-llm Exploitation status Not known exploited Fix Affected product M mintplex-labs/anything-llm Published 04/16/2024 Severity Critical CVE-2024-3570Stored XSS leading to Admin Account Takeover in mintplex-labs/anything-llm Exploitation status Not known exploited Fix Affected product M mintplex-labs/anything-llm Published 04/10/2024 Severity Informational CVE-2024-3101Privilege Escalation via Improper Input Validation in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 04/10/2024 Severity Medium CVE-2024-3283Privilege Escalation via Mass Assignment in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 04/10/2024 Severity High CVE-2024-3569Denial of Service (DoS) Vulnerability in mintplex-labs/anything-llm Exploitation status Not known exploited Fix Affected product M mintplex-labs/anything-llm Published 04/10/2024 Severity High CVE-2024-3025Path Traversal in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 04/10/2024 Severity Critical CVE-2024-0765Default user role exporting save state of instance Exploitation status Not known exploited Fix Affected product M mintplex-labs/anything-llm Published 03/03/2024 Severity Critical CVE-2024-0795Create user API role not enforced Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 03/02/2024 Severity High CVE-2024-0550Privileged User using traversal to read system files Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 02/28/2024 Severity Critical CVE-2024-0763Improper validation of document removal parameter Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 02/27/2024 Severity High CVE-2024-0551Download and export of file via default user role Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 02/27/2024 Severity High CVE-2024-0759Collection of internally resolving IPs Exploitation status Not known exploited Fix Affected product M mintplex-labs/anything-llm Published 02/27/2024 Severity High CVE-2024-0439User can manually send request at manager permission to modify system configurations Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 02/25/2024 Severity High CVE-2024-0440SSRF - file:// unsanitized access to underlying host files Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 02/25/2024 Severity Critical CVE-2024-0435User can submit message to self-XSS Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 02/25/2024 Severity High CVE-2024-0798Privilege Escalation in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 02/25/2024 Severity High CVE-2024-0436Prevent timing attack for single-user password check Exploitation status Not known exploited Fix Affected product M mintplex-labs/anything-llm Published 02/25/2024 Severity High CVE-2024-0455SSRF on AWS deployed instances of AnythingLLM via /metadata Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 02/25/2024 Severity Critical CVE-2024-0879Authentication bypass in vector-admin domain restriction Exploitation status Not known exploited Fix Affected product V vector-admin Published 01/25/2024 Severity Medium CVE-2024-22422Unauthenticated Denial of Service (DOS) attack in AnythingLLM Exploitation status Public exploit Fix Not confirmed Affected product A anything-llm Published 01/19/2024 Severity High CVE-2023-5833Improper Access Control in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 10/30/2023 Severity High CVE-2023-5832Improper Input Validation in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 10/30/2023 Severity Critical CVE-2023-4899SQL Injection in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 09/11/2023 Severity High CVE-2023-4898Authentication Bypass by Primary Weakness in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 09/11/2023 Severity High CVE-2023-4897Relative Path Traversal in mintplex-labs/anything-llm Exploitation status Public exploit Fix Affected product M mintplex-labs/anything-llm Published 09/11/2023 Severity High 
