CVE Tools
Track your stack

Mintplexlabs

42 CVEs tracked since 2024. Since Feb 2024, none of them reached CISA KEV.

Mintplexlabs CVEs per month

Feb 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Mintplexlabs CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2024-02100
2024-034 or fewer
2024-0490
2024-055 or fewer
2024-06140
2024-074 or fewer
2024-084 or fewer
2024-093 or fewer
2024-104 or fewer
2024-114 or fewer
2024-123 or fewer
2025-014 or fewer
2025-023 or fewer
2025-0390
2025-044 or fewer
2025-054 or fewer
2025-064 or fewer
2025-075 or fewer
2025-084 or fewer
2025-094 or fewer
2025-104 or fewer
2025-114 or fewer
2025-125 or fewer
2026-015 or fewer
2026-025 or fewer
2026-037 or fewer
2026-046 or fewer
2026-057 or fewer
2026-067 or fewer
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-106 or fewer

Products

The products that kept showing up in Mintplexlabs's monthly top three, with their CVEs summed over those months.

  1. Mintplex-labs/anything-llm424 months
  2. Anythingllm394 months
  3. Anythingllm Desktop11 month
  4. Anythingllm Webapp11 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Mintplexlabs.

  1. CVE-2026-47713AnythingLLM: Legacy mobile device tokens bypass multi-user workspace scoping after mode migration2.0
  2. CVE-2026-48116AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill7.5
  3. CVE-2026-45403AnythingLLM: filesystem-copy-file follows nested symlinks and copies files from outside the allowed directory2.0
  4. CVE-2026-42456AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (IDOR)4.3
  5. CVE-2026-41318AnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable component5.4
  6. CVE-2026-5627Path Traversal in mintplex-labs/anything-llm7.2
  7. CVE-2026-32719AnythingLLM has a Zip Slip Path Traversal and Code Execution via Community Hub Plugin Import4.2
  8. CVE-2026-32717AnythingLLM access control bypass: suspended users can continue using Browser Extension API keys2.7
  9. CVE-2026-32715AnythingLLM Manager Privilege Bypass Allows Access to Admin-Only System Preferences3.8
  10. CVE-2026-32628AnythingLLM has SQL Injection in Built-in SQL Agent Plugin via Unsanitized table_name Parameter8.8
  11. CVE-2026-32626AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection9.6
  12. CVE-2026-32617AnythingLLM Permissable CORS policy7.1
  13. CVE-2026-24478AnythingLLM vulnerable to Path Traversal7.2
  14. CVE-2026-24477AnythingLLM has key leak in `systemSettings.js`7.5
  15. CVE-2026-21484AnythingLLM Vulnerable to Username Enumeration w/ Password Recovery5.3

The record

Peak rank
#44 in Jun 2024
Busiest month shown
Jun 2024, 14 CVEs
Months with a KEV entry
0 since Feb 2024
Monthly snapshots
4 since 2024
Mintplexlabs's full record, month by month