Anything Llm CVE-2026-42456

SQL Injection in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. Rated high severity (CVSS 8.8), this vulne

Authentication Bypass by Primary Weakness in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. Rated high sev

XSS in AnythingLLM 1.11.1 and earlier.

SQL injection in AnythingLLM versions 1.11.1 and earlier enables authenticated users to execute arbitrary SQL commands a

AnythingLLM versions 1.11.1 and earlier contain an authentication bypass vulnerability on default installations where th

Stored DOM-level XSS in AnythingLLM's chart caption rendering allows authenticated users in shared workspaces to inject

Path traversal in AnythingLLM's document folder listing endpoint on Windows allows authenticated low-privilege users to

AnythingLLM versions 1.11.1 and earlier contain a Zip Slip path traversal vulnerability in the community plugin import f

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti

Stale mobile device tokens in AnythingLLM survive single-user to multi-user mode migration with a null userId, allowing

Symlink following in the AnythingLLM agent filesystem copy tool (versions prior to 1.13.0) allows a highly-privileged au