Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: mintplex-labs/anything-llm 1.3.1 Clear all filters
TI-2024-09371 CVE-2024-10109 · GHSA-5jmj-h3c5-682w

Incorrect Authorization in mintplex-labs/anything-llm

Priority HIGH 69

A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/system/custom-models".

CVSS 3.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00528 Published 2025-03-20 Fixed in 1.3.1 CWE-863
TI-2024-07205 CVE-2024-7771 · GHSA-q8pp-mmm3-9j9w

Denial of Service in mintplex-labs/anything-llm

Priority MEDIUM 62

A vulnerability in the Dockerized version of mintplex-labs/anything-llm (latest, digest 1d9452da2b92) allows for a denial of service.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00778 Published 2025-03-20 Fixed in 1.3.1 CWE-400
TI-2024-12108 CVE-2024-13060 · GHSA-mjvp-pg3h-wh59

Improper Authorization in mintplex-labs/anything-llm

Priority MEDIUM 53

A vulnerability in AnythingLLM Docker version 1.3.1 allows users with 'Default' permission to access other users' profile pictures by changing the 'id' parameter in the user cookie.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0049 Published 2025-03-20 Fixed in 1.3.1 CWE-862