# cve.now: Significant-gravitas

The newest entries naming Significant-gravitas as an affected vendor (up to 200), of 41 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-72922](https://cve.now/CVE-2026-72922.md): AutoGPT: Webhook provider path confusion bypasses generic webhook secret verification (CVSS 8.2)
- [CVE-2025-32394](https://cve.now/CVE-2025-32394.md): AutoGPT: There is a DoS vulnerability in AITextSummarizerBlock (CVSS 5.3)
- [CVE-2025-32423](https://cve.now/CVE-2025-32423.md): AutoGPT: There is a DoS vulnerability in ExtractTextInformationBlock (CVSS 5.3)
- [CVE-2026-56663](https://cve.now/CVE-2026-56663.md): AutoGPT: SSRF-to-RCE Chain in \`SendWebRequestBlock\` via IP validation bypass and internal \`pg-meta\` access (CVSS 8.5)
- [CVE-2026-56823](https://cve.now/CVE-2026-56823.md): AutoGPT: IDOR in Webhook Ping Endpoint Allows Enumeration and Cross-User Ping Triggering (CVSS 5.4)
- [CVE-2026-33235](https://cve.now/CVE-2026-33235.md): AutoGPT: Denial of Service (DoS) via Resource Exhaustion in text templating features (CVSS 7.7)
- [CVE-2026-55237](https://cve.now/CVE-2026-55237.md): AutoGPT SignUp Page has DOM-Based XSS and Open Redirect (CVSS 8.8)
- [CVE-2025-32437](https://cve.now/CVE-2025-32437.md): AutoGPT has a DoS vulnerability in MediaDurationBlock (CVSS 8.7)
- [CVE-2025-32436](https://cve.now/CVE-2025-32436.md): AutoGPT has a DoS vulnerability in AddAudioToVideoBlock (CVSS 7.1)
- [CVE-2025-32424](https://cve.now/CVE-2025-32424.md): AutoGPT has a DoS vulnerability in ScreenshotWebPageBlock (CVSS 8.7)
- [CVE-2025-32422](https://cve.now/CVE-2025-32422.md): AutoGPT has a DoS vulnerability in FileStoreBlock with StepThroughItemsBlock (CVSS 8.7)
- [CVE-2025-32392](https://cve.now/CVE-2025-32392.md): AutoGPT has a DoS vulnerability in LoopVideoBlock (CVSS 8.7)
- [CVE-2026-45023](https://cve.now/CVE-2026-45023.md): AutoGPT: Credit system bypassed via direct block execution in POST /api/blocks/{block\_id}/execute (CVSS 5.4)
- [CVE-2026-33234](https://cve.now/CVE-2026-33234.md): AutoGPT: SendEmailBlock's IP blocklist bypass allows SSRF via user-controlled SMTP server (CVSS 5.0)
- [CVE-2026-33233](https://cve.now/CVE-2026-33233.md): AutoGPT Platform: Remote Code Execution via Unsafe Pickle Deserialization of Redis Cache Entries (CVSS 7.6)
- [CVE-2026-33232](https://cve.now/CVE-2026-33232.md): AutoGPT: Unauthenticated DoS via Disk Space Exhaustion (CVSS 7.5)
- [CVE-2026-30950](https://cve.now/CVE-2026-30950.md): AutoGPT has Authenticated Session Hijacking via IDOR (CVSS 7.1)
- [CVE-2025-32425](https://cve.now/CVE-2025-32425.md): AutoGPT has missing Docker log rotation on platform containers that allows host disk-exhaustion DoS (CVSS 5.1)
- [CVE-2026-26020](https://cve.now/CVE-2026-26020.md): AutoGPT Affected by Remote Code Execution via Dynamic Module Import in Block Loading (\_\_import\_\_) (CVSS 9.4)
- [CVE-2026-26006](https://cve.now/CVE-2026-26006.md): Redos (Regular Expression Denial of Service) at Code Extraction Block in significant-gravitas/autogpt (CVSS 6.5)
- [CVE-2025-32393](https://cve.now/CVE-2025-32393.md): AutoGPT has a DoS vulnerability in ReadRSSFeedBlock (CVSS 8.7)
- [CVE-2025-62616](https://cve.now/CVE-2025-62616.md): AutoGPT has SSRF vulnerability in SendDiscordFileBlock (CVSS 9.3)
- [CVE-2025-62615](https://cve.now/CVE-2025-62615.md): AutoGPT has SSRF vulnerability in ReadRSSFeedBlock (CVSS 9.3)
- [CVE-2026-22038](https://cve.now/CVE-2026-22038.md): AutoGPT's API Keys and Secrets Logged in Plaintext in Stagehand Integration Blocks (CVSS 8.1)
- [CVE-2026-24780](https://cve.now/CVE-2026-24780.md): AutoGPT is Vulnerable to RCE via Disabled Block Execution (CVSS 8.6)
- [CVE-2025-53944](https://cve.now/CVE-2025-53944.md): AutoGPT Platform Exposes Graph Execution Results via Authorization Gap (CVSS 7.7)
- [CVE-2025-31494](https://cve.now/CVE-2025-31494.md): AutoGPT allows cross-user sharing of node execution results through WebSockets API (CVSS 3.5)
- [CVE-2025-31491](https://cve.now/CVE-2025-31491.md): AutoGPT allows leakage of cross-domain cookies and protected headers in requests redirect (CVSS 8.6)
- [CVE-2025-31490](https://cve.now/CVE-2025-31490.md): AutoGPT allows SSRF due to DNS Rebinding in requests wrapper (CVSS 7.5)
- [CVE-2024-10457](https://cve.now/CVE-2024-10457.md): SSRF Vulnerabilities in significant-gravitas/autogpt (CVSS 6.5)
- [CVE-2025-0454](https://cve.now/CVE-2025-0454.md): SSRF Check Bypass in Requests Utility in significant-gravitas/autogpt (CVSS 7.5)
- [CVE-2025-1040](https://cve.now/CVE-2025-1040.md): Server-Side Template Injection (SSTI) in significant-gravitas/autogpt (CVSS 8.8)
- [CVE-2024-8156](https://cve.now/CVE-2024-8156.md): Command Injection in significant-gravitas/autogpt (CVSS 8.8)
- [CVE-2025-22603](https://cve.now/CVE-2025-22603.md): AutoGPT SSRF vulnerability (CVSS 7.7)
- [CVE-2024-6091](https://cve.now/CVE-2024-6091.md): Shell Command Denylist Bypass in significant-gravitas/autogpt (CVSS 9.8)
- [CVE-2024-1880](https://cve.now/CVE-2024-1880.md): OS Command Injection in MacOS Text-To-Speech Class in significant-gravitas/autogpt (CVSS 7.8)
- [CVE-2024-1881](https://cve.now/CVE-2024-1881.md): Improper Neutralization of Special Elements used in an OS Command in significant-gravitas/autogpt (CVSS 8.8)
- [CVE-2024-1879](https://cve.now/CVE-2024-1879.md): CSRF to RCE in significant-gravitas/autogpt (CVSS 8.8)
- [CVE-2023-37275](https://cve.now/CVE-2023-37275.md): System logs spoofable in Auto-GPT via ANSI control sequences (CVSS 3.1)
- [CVE-2023-37274](https://cve.now/CVE-2023-37274.md): Python code execution sandbox escape in non-docker version in Auto-GPT (CVSS 7.6)
- [CVE-2023-37273](https://cve.now/CVE-2023-37273.md): Docker escape in Auto-GPT when running from docker-compose.yml included in git repo (CVSS 8.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/significant-gravitas
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.