CVE-2026-21484: falha de média gravidade em Mintplex-Labs anything-llm
AnythingLLM Vulnerable to Username Enumeration w/ Password Recovery
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Corrija em breve. Ela tem exploit funcional público.
ssvc Attendcvss 5.3epss 0.8%
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to commit e287fab56089cf8fcea9ba579a3ecdeca0daa313, the password recovery endpoint returns different error messages depending on whether a username exists, so enabling username enumeration. Commit e287fab56089cf8fcea9ba579a3ecdeca0daa313 fixes this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
Mintplex-Labs · anything-llmCVEs relacionadas — Mintplex-Labs anything-llm
No mesmo produto, das mais perigosas para as menos.
CVE-2026-24477HIGHAnythingLLM has key leak in `systemSettings.js`EPSS 2.1%CVE-2024-22422HIGHUnauthenticated Denial of Service (DOS) attack in AnythingLLMEPSS 1.0%CVE-2026-24478HIGHAnythingLLM vulnerable to Path TraversalEPSS 0.9%CVE-2026-32626CRITICALAnythingLLM has a Streaming Phase XSS to RCE via LLM Response InjectionEPSS 0.8%CVE-2026-32617HIGHAnythingLLM Permissable CORS policyEPSS 0.5%CVE-2026-32719MEDIUMAnythingLLM has a Zip Slip Path Traversal and Code Execution via Community Hub Plugin ImportEPSS 0.5%