https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 12:11:53 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-158060 EUVD-2026-158060 https://cve.radiocsirt.org/vuln/euvd-2026-158060 https://cve.radiocsirt.org/vuln/fkie_cve-2024-0759 <p>Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or admin, they could link-scrape internally resolving IPs of other services that are on the same network as AnythingLLM.</p> <p>This would require the attacker also be able to guess these internal IPs as `/*` ranging is not possible, but could be brute forced.</p> <p>There is a duty of care that other services on the same network would not be fully open and accessible via a simple CuRL with zero authentication as it is not possible to set headers or access via the link collector.</p> <p>Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or admin, they could link-scrape internally resolving IPs of other services that are on the same network as AnythingLLM.</p> <p>This would require the attacker also be able to guess these internal IPs as `/*` ranging is not possible, but could be brute forced.</p> <p>There is a duty of care that other services on the same network would not be fully open and accessible via a simple CuRL with zero authentication as it is not possible to set headers or access via the link collector.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-0759 https://cve.radiocsirt.org/vuln/ghsa-cw8v-p9jq-r69x <p>Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or admin, they could link-scrape internally resolving IPs of other services that are on the same network as AnythingLLM.</p> <p>This would require the attacker also be able to guess these internal IPs as `/*` ranging is not possible, but could be brute forced.</p> <p>There is a duty of care that other services on the same network would not be fully open and accessible via a simple CuRL with zero authentication as it is not possible to set headers or access via the link collector.</p> <p>Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or admin, they could link-scrape internally resolving IPs of other services that are on the same network as AnythingLLM.</p> <p>This would require the attacker also be able to guess these internal IPs as `/*` ranging is not possible, but could be brute forced.</p> <p>There is a duty of care that other services on the same network would not be fully open and accessible via a simple CuRL with zero authentication as it is not possible to set headers or access via the link collector.</p> https://cve.radiocsirt.org/vuln/ghsa-cw8v-p9jq-r69x https://cve.radiocsirt.org/vuln/gsd-2024-0759 gsd-2024-0759 https://cve.radiocsirt.org/vuln/gsd-2024-0759