Significant-Gravitas AutoGPT

• CVE-2026-72922 High 8.2 AutoGPT: Webhook provider path confusion bypasses generic webhook secret verification 0.5%
• CVE-2025-32394 Medium 5.3 AutoGPT: There is a DoS vulnerability in AITextSummarizerBlock 0.4%
• CVE-2025-32423 Medium 5.3 AutoGPT: There is a DoS vulnerability in ExtractTextInformationBlock 0.3%
• CVE-2026-56663 High 8.5 AutoGPT: SSRF-to-RCE Chain in `SendWebRequestBlock` via IP validation bypass and internal `pg-meta` access 0.3%
• CVE-2026-56823 Medium 5.4 AutoGPT: IDOR in Webhook Ping Endpoint Allows Enumeration and Cross-User Ping Triggering 0.2%
• CVE-2026-33235 High 7.7 AutoGPT: Denial of Service (DoS) via Resource Exhaustion in text templating features 0.4%
• CVE-2026-55237 High 8.8 AutoGPT SignUp Page has DOM-Based XSS and Open Redirect 0.2%
• CVE-2025-32437 High 8.7 AutoGPT has a DoS vulnerability in MediaDurationBlock 0.3%
• CVE-2025-32436 High 7.1 AutoGPT has a DoS vulnerability in AddAudioToVideoBlock 0.3%
• CVE-2025-32424 High 8.7 AutoGPT has a DoS vulnerability in ScreenshotWebPageBlock 0.3%
• CVE-2025-32422 High 8.7 AutoGPT has a DoS vulnerability in FileStoreBlock with StepThroughItemsBlock 0.3%
• CVE-2025-32392 High 8.7 AutoGPT has a DoS vulnerability in LoopVideoBlock 0.4%
• CVE-2026-45023 Medium 5.4 AutoGPT: Credit system bypassed via direct block execution in POST /api/blocks/{block_id}/execute 0.2%
• CVE-2026-33234 Medium 5.0 AutoGPT: SendEmailBlock's IP blocklist bypass allows SSRF via user-controlled SMTP server 0.3%
• CVE-2026-33233 High 7.6 AutoGPT Platform: Remote Code Execution via Unsafe Pickle Deserialization of Redis Cache Entries 0.2%
• CVE-2026-33232 High 7.5 AutoGPT: Unauthenticated DoS via Disk Space Exhaustion 0.4%
• CVE-2026-30950 High 7.1 AutoGPT has Authenticated Session Hijacking via IDOR 0.4%
• CVE-2025-32425 Medium 5.1 AutoGPT has missing Docker log rotation on platform containers that allows host disk-exhaustion DoS 0.2%
• CVE-2026-26020 Critical 9.4 AutoGPT Affected by Remote Code Execution via Dynamic Module Import in Block Loading (__import__) 0.6%
• CVE-2026-26006 Medium 6.5 Redos (Regular Expression Denial of Service) at Code Extraction Block in significant-gravitas/autogpt 0.5%
• CVE-2025-32393 High 8.7 AutoGPT has a DoS vulnerability in ReadRSSFeedBlock 0.4%
• CVE-2025-62616 Critical 9.3 AutoGPT has SSRF vulnerability in SendDiscordFileBlock 0.4%
• CVE-2025-62615 Critical 9.3 AutoGPT has SSRF vulnerability in ReadRSSFeedBlock 0.4%
• CVE-2026-22038 High 8.1 AutoGPT's API Keys and Secrets Logged in Plaintext in Stagehand Integration Blocks 0.5%
• CVE-2026-24780 High 8.6 AutoGPT is Vulnerable to RCE via Disabled Block Execution 1.3%
• CVE-2025-53944 High 7.7 AutoGPT Platform Exposes Graph Execution Results via Authorization Gap 0.5%
• CVE-2025-31494 Low 3.5 AutoGPT allows cross-user sharing of node execution results through WebSockets API 0.4%
• CVE-2025-31491 High 8.6 AutoGPT allows leakage of cross-domain cookies and protected headers in requests redirect 0.5%
• CVE-2025-31490 High 7.5 AutoGPT allows SSRF due to DNS Rebinding in requests wrapper 0.5%
• CVE-2025-22603 High 7.7 AutoGPT SSRF vulnerability 0.6%