Significant-gravitas vulnerabilities
41 CVEs and advisories name Significant-gravitas as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-72922AutoGPT: Webhook provider path confusion bypasses generic webhook secret verification
- CVE-2025-32394AutoGPT: There is a DoS vulnerability in AITextSummarizerBlock
- CVE-2025-32423AutoGPT: There is a DoS vulnerability in ExtractTextInformationBlock
- CVE-2026-56663AutoGPT: SSRF-to-RCE Chain in `SendWebRequestBlock` via IP validation bypass and internal `pg-meta` access
- CVE-2026-56823AutoGPT: IDOR in Webhook Ping Endpoint Allows Enumeration and Cross-User Ping Triggering
- CVE-2026-33235AutoGPT: Denial of Service (DoS) via Resource Exhaustion in text templating features
- CVE-2026-55237AutoGPT SignUp Page has DOM-Based XSS and Open Redirect
- CVE-2025-32437AutoGPT has a DoS vulnerability in MediaDurationBlock
- CVE-2025-32436AutoGPT has a DoS vulnerability in AddAudioToVideoBlock
- CVE-2025-32424AutoGPT has a DoS vulnerability in ScreenshotWebPageBlock
- CVE-2025-32422AutoGPT has a DoS vulnerability in FileStoreBlock with StepThroughItemsBlock
- CVE-2025-32392AutoGPT has a DoS vulnerability in LoopVideoBlock
- CVE-2026-45023AutoGPT: Credit system bypassed via direct block execution in POST /api/blocks/{block_id}/execute
- CVE-2026-33234AutoGPT: SendEmailBlock's IP blocklist bypass allows SSRF via user-controlled SMTP server
- CVE-2026-33233AutoGPT Platform: Remote Code Execution via Unsafe Pickle Deserialization of Redis Cache Entries
- CVE-2026-33232AutoGPT: Unauthenticated DoS via Disk Space Exhaustion
- CVE-2026-30950AutoGPT has Authenticated Session Hijacking via IDOR
- CVE-2025-32425AutoGPT has missing Docker log rotation on platform containers that allows host disk-exhaustion DoS
- CVE-2026-26020AutoGPT Affected by Remote Code Execution via Dynamic Module Import in Block Loading (__import__)
- CVE-2026-26006Redos (Regular Expression Denial of Service) at Code Extraction Block in significant-gravitas/autogpt
- CVE-2025-32393AutoGPT has a DoS vulnerability in ReadRSSFeedBlock
- CVE-2025-62616AutoGPT has SSRF vulnerability in SendDiscordFileBlock
- CVE-2025-62615AutoGPT has SSRF vulnerability in ReadRSSFeedBlock
- CVE-2026-22038AutoGPT's API Keys and Secrets Logged in Plaintext in Stagehand Integration Blocks
- CVE-2026-24780AutoGPT is Vulnerable to RCE via Disabled Block Execution
- CVE-2025-53944AutoGPT Platform Exposes Graph Execution Results via Authorization Gap
- CVE-2025-31494AutoGPT allows cross-user sharing of node execution results through WebSockets API
- CVE-2025-31491AutoGPT allows leakage of cross-domain cookies and protected headers in requests redirect
- CVE-2025-31490AutoGPT allows SSRF due to DNS Rebinding in requests wrapper
- CVE-2024-10457SSRF Vulnerabilities in significant-gravitas/autogpt