CVEs we hold for Significant-gravitas
Records whose assigning authority named Significant-gravitas as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-72922AutoGPT: Webhook provider path confusion bypasses generic webhook secret verificationSignificant-Gravitas AutoGPT
CVE-2026-56823AutoGPT: IDOR in Webhook Ping Endpoint Allows Enumeration and Cross-User Ping TriggeringSignificant-Gravitas AutoGPT
CVE-2026-56663AutoGPT: SSRF-to-RCE Chain in `SendWebRequestBlock` via IP validation bypass and internal `pg-meta` accessSignificant-Gravitas AutoGPT
CVE-2026-45023AutoGPT: Credit system bypassed via direct block execution in POST /api/blocks/{block_id}/executeSignificant-Gravitas AutoGPT
CVE-2026-33235AutoGPT: Denial of Service (DoS) via Resource Exhaustion in text templating featuresSignificant-Gravitas AutoGPT
CVE-2026-33234AutoGPT: SendEmailBlock's IP blocklist bypass allows SSRF via user-controlled SMTP serverSignificant-Gravitas AutoGPT
CVE-2026-33233AutoGPT Platform: Remote Code Execution via Unsafe Pickle Deserialization of Redis Cache EntriesSignificant-Gravitas AutoGPT
CVE-2026-26020AutoGPT Affected by Remote Code Execution via Dynamic Module Import in Block Loading (__import__)Significant-Gravitas AutoGPT
CVE-2026-26006Redos (Regular Expression Denial of Service) at Code Extraction Block in significant-gravitas/autogptSignificant-Gravitas AutoGPT
CVE-2026-22038AutoGPT's API Keys and Secrets Logged in Plaintext in Stagehand Integration BlocksSignificant-Gravitas AutoGPT
CVE-2025-53944AutoGPT Platform Exposes Graph Execution Results via Authorization GapSignificant-Gravitas AutoGPT
CVE-2025-32425AutoGPT has missing Docker log rotation on platform containers that allows host disk-exhaustion DoSSignificant-Gravitas AutoGPT
CVE-2025-32423AutoGPT: There is a DoS vulnerability in ExtractTextInformationBlockSignificant-Gravitas AutoGPT
CVE-2025-32422AutoGPT has a DoS vulnerability in FileStoreBlock with StepThroughItemsBlockSignificant-Gravitas AutoGPT
CVE-2025-32394AutoGPT: There is a DoS vulnerability in AITextSummarizerBlockSignificant-Gravitas AutoGPT
CVE-2025-31494AutoGPT allows cross-user sharing of node execution results through WebSockets APISignificant-Gravitas AutoGPT
CVE-2025-31491AutoGPT allows leakage of cross-domain cookies and protected headers in requests redirectSignificant-Gravitas AutoGPT
CVE-2025-31490AutoGPT allows SSRF due to DNS Rebinding in requests wrapperSignificant-Gravitas AutoGPT
CVE-2025-1040Server-Side Template Injection (SSTI) in significant-gravitas/autogptsignificant-gravitas/autogpt
CVE-2025-0454SSRF Check Bypass in Requests Utility in significant-gravitas/autogptsignificant-gravitas/autogpt
CVE-2024-6091Shell Command Denylist Bypass in significant-gravitas/autogptsignificant-gravitas/autogpt
CVE-2024-1881Improper Neutralization of Special Elements used in an OS Command in significant-gravitas/autogptsignificant-gravitas/autogpt
CVE-2024-1880OS Command Injection in MacOS Text-To-Speech Class in significant-gravitas/autogptsignificant-gravitas/autogpt
CVE-2023-37275System logs spoofable in Auto-GPT via ANSI control sequencesSignificant-Gravitas Auto-GPT
CVE-2023-37274Python code execution sandbox escape in non-docker version in Auto-GPTSignificant-Gravitas Auto-GPT
CVE-2023-37273Docker escape in Auto-GPT when running from docker-compose.yml included in git repoSignificant-Gravitas Auto-GPT
41 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.