Anythingllm Desktop

2 CVEs product

Monthly

Sort: Newest CVSS Score EPSS Score Oldest

CVE-2024-8196 Mar 20, 10:15 CRITICAL POC PATCH Act Now

In mintplex-labs/anything-llm v1.5.11 desktop version for Windows, the application opens server port 3001 on 0.0.0.0 with no authentication by default. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Windows Authentication Bypass Microsoft Anythingllm Desktop Mintplexlabs

NVD GitHub

CVSS 3.0

9.8

EPSS

0.2%

CVE-2024-3166 Jun 06, 19:16 CRITICAL POC PATCH Act Now

A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version 1.2.0 and the latest version of the web application. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

XSS RCE Anythingllm Docker Anythingllm Desktop Mintplexlabs

NVD GitHub

CVSS 3.1

9.6

EPSS

1.0%

CVE-2024-8196

EPSS 0% CVSS 9.8

CRITICAL POC PATCH Act Now

Windows Authentication Bypass Microsoft +2

NVD GitHub

CVE-2024-3166

EPSS 1% CVSS 9.6

CRITICAL POC PATCH Act Now

XSS RCE Anythingllm Docker +2

NVD GitHub