OpenBMB XAgent vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 20251
3. 20265

Newest CVEs

• CVE-2026-72713

  XAgent Path Traversal Arbitrary File Read via /workspace/file

  OpenBMB · XAgent

  High8.7
• CVE-2026-4959

  OpenBMB XAgent ShareServer WebSocket Endpoint share.py check_user missing authentication

  OpenBMB · XAgent

  Medium6.9
• CVE-2026-4958

  OpenBMB XAgent WebSocket Endpoint replayer.py ReplayServer.send_data authorization

  OpenBMB · XAgent

  Low2.3
• CVE-2026-4957

  OpenBMB XAgent API Key function_handler.py FunctionHandler.handle_tool_call log file

  OpenBMB · XAgent

  Medium5.1
• CVE-2026-3954

  OpenBMB XAgent workspace.py workspace path traversal

  OpenBMB · XAgent

  Medium6.9
• CVE-2025-6281

  OpenBMB XAgent community path traversal

  OpenBMB · XAgent

  Medium5.1
• CVE-2024-2007

  OpenBMB XAgent Privileged Mode sandbox

  OpenBMB · XAgent

  Medium5.3