OOpenBMB

Products

Exploited and recent CVEs

• CVE-2026-123032 High 7.3 OpenBMB Internet of Agents WebSocket Connection Manager app.py ConnectionManager.connect missing authentication 0.6%
• CVE-2026-111636 High 8.1 OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret 0.4%
• CVE-2026-72713 High 7.5 XAgent Path Traversal Arbitrary File Read via /workspace/file 0.8%
• CVE-2026-58166 Critical 9.1 OpenBMB ChatDev - Unauthenticated Path Traversal in Upload Handler Allows Arbitrary File Write and Delete 0.9%
• CVE-2026-4959 High 7.3 OpenBMB XAgent ShareServer WebSocket Endpoint share.py check_user missing authentication 0.4%
• CVE-2026-4958 Low 3.1 OpenBMB XAgent WebSocket Endpoint replayer.py ReplayServer.send_data authorization 0.4%
• CVE-2026-4957 Low 2.7 OpenBMB XAgent API Key function_handler.py FunctionHandler.handle_tool_call log file 0.3%
• CVE-2026-3954 Medium 6.5 OpenBMB XAgent workspace.py workspace path traversal 0.5%
• CVE-2025-6281 Medium 5.5 OpenBMB XAgent community path traversal 0.5%
• CVE-2024-2007 Medium 5.3 OpenBMB XAgent Privileged Mode sandbox 0.3%