OpenBMB vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 20251
3. 20267

Newest CVEs

• CVE-2026-111636

  OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret

  OpenBMB · StaffDeck

  Critical9.2
• CVE-2026-72713

  XAgent Path Traversal Arbitrary File Read via /workspace/file

  OpenBMB · XAgent

  High8.7
• CVE-2026-58166

  OpenBMB ChatDev - Unauthenticated Path Traversal in Upload Handler Allows Arbitrary File Write and Delete

  OpenBMB · ChatDev

  High8.8
• CVE-2026-4959

  OpenBMB XAgent ShareServer WebSocket Endpoint share.py check_user missing authentication

  OpenBMB · XAgent

  Medium6.9
• CVE-2026-4958

  OpenBMB XAgent WebSocket Endpoint replayer.py ReplayServer.send_data authorization

  OpenBMB · XAgent

  Low2.3
• CVE-2026-4957

  OpenBMB XAgent API Key function_handler.py FunctionHandler.handle_tool_call log file

  OpenBMB · XAgent

  Medium5.1
• CVE-2026-3954

  OpenBMB XAgent workspace.py workspace path traversal

  OpenBMB · XAgent

  Medium6.9
• CVE-2025-6281

  OpenBMB XAgent community path traversal

  OpenBMB · XAgent

  Medium5.1
• CVE-2024-2007

  OpenBMB XAgent Privileged Mode sandbox

  OpenBMB · XAgent

  Medium5.3