https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-4959.htmlhttps://patchthecve.com/cve/CVE-2026-4959.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 7.3: A vulnerability was found in OpenBMB XAgent 1.0.0. This impacts the function check_user of the file XAgentServer/application/websockets/share.py of the component ShareServer WebSocket Endpoint. Performing a manipulation of the argument interaction_id results in missing authentication. Remote exploithttps://patchthecve.com/cve/CVE-2026-4958.htmlhttps://patchthecve.com/cve/CVE-2026-4958.htmlMon, 26 Oct 2026 22:10:00 +0000LOW 3.1: A vulnerability has been found in OpenBMB XAgent 1.0.0. This affects the function ReplayServer.on_connect/ReplayServer.send_data of the file XAgentServer/application/websockets/replayer.py of the component WebSocket Endpoint. Such manipulation of the argument interaction_id leads to authorization byhttps://patchthecve.com/cve/CVE-2026-4957.htmlhttps://patchthecve.com/cve/CVE-2026-4957.htmlMon, 26 Oct 2026 22:10:00 +0000LOW 2.7: A flaw has been found in OpenBMB XAgent 1.0.0. The impacted element is the function FunctionHandler.handle_tool_call of the file XAgent/function_handler.py of the component API Key Handler. This manipulation of the argument api_key causes sensitive information in log files. The attack may be initiat