Threats Tagged 'cve-2026-32617'
View all threats tagged with 'cve-2026-32617'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2026-32617'
Click on any threat for detailed analysis and mitigation recommendations
CVE-2026-32617: CWE-942: Permissive Cross-domain Policy with Untrusted Domains in Mintplex-Labs anything-llmCVE-2026-32617 0 AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, On default installations where no password or API key has been configured, all HTTP endpoints and the agent WebSocket lack authentication, and the server's CORS policy accepts any origin. AnythingLLM Desktop binds to 127.0.0.1 (loopback) by default. Modern browsers (Chrome, Edge, Firefox) implement Private Network Access (PNA). This explicitly blocks public websites from making requests to local IP addresses. Exploitation is only viable from within the same local network (LAN) due to browser-level blocking of public-to-private requests. Join the discussion | CVE Database V5 | 03/13/2026, 20:07:57 UTC Added: 03/13/2026, 20:29:49 UTC |
Showing 1 to 1 of 1 result