XAgent
- Software type
- software-application
- Total vulnerabilities (90 days)
- 1
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, XAgent recorded 1 security vulnerability in the last 90 days, of which 1 is rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of XAgent and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-72713XAgent Path Traversal Arbitrary File Read via /workspace/fileCVE-2026-4959OpenBMB XAgent ShareServer WebSocket Endpoint share.py check_user missing authenticationCVE-2026-4958OpenBMB XAgent WebSocket Endpoint replayer.py ReplayServer.send_data authorizationCVE-2026-4957OpenBMB XAgent API Key function_handler.py FunctionHandler.handle_tool_call log fileCVE-2026-3954OpenBMB XAgent workspace.py workspace path traversal| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-72713XAgent Path Traversal Arbitrary File Read via /workspace/file | Exploitation statusActively exploited | FixYes | Published08/11/2026 | SeverityHigh |
CVE-2026-4959OpenBMB XAgent ShareServer WebSocket Endpoint share.py check_user missing authentication | Exploitation statusActively exploited | FixNo | Published03/27/2026 | SeverityMedium |
CVE-2026-4958OpenBMB XAgent WebSocket Endpoint replayer.py ReplayServer.send_data authorization | Exploitation statusActively exploited | FixNo | Published03/27/2026 | SeverityLow |
CVE-2026-4957OpenBMB XAgent API Key function_handler.py FunctionHandler.handle_tool_call log file | Exploitation statusActively exploited | FixNo | Published03/27/2026 | SeverityMedium |
CVE-2026-3954OpenBMB XAgent workspace.py workspace path traversal | Exploitation statusActively exploited | FixNo | Published03/11/2026 | SeverityMedium |
CVE-2025-6281OpenBMB XAgent community path traversal | Exploitation statusActively exploited | FixNo | Published06/19/2025 | SeverityMedium |
CVE-2024-2007OpenBMB XAgent Privileged Mode sandbox | Exploitation statusActively exploited | FixNo | Published02/29/2024 | SeverityMedium |
7 Results | Page 1 of 1