AU
Product
AutoGPT
29
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 18Medium 8Low 1
Watch
Add AutoGPT to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-62616 | 9.8 | Feb 4 | AutoGPT has SSRF vulnerability in SendDiscordFileBlock Affected: < autogpt-platform-beta-v0.6.34 |
| CVE-2025-62615 | 9.8 | Feb 4 | AutoGPT has SSRF vulnerability in ReadRSSFeedBlock Affected: < autogpt-platform-beta-v0.6.34 |
| CVE-2026-55237 | 8.8 | Jun 18 | AutoGPT SignUp Page has DOM-Based XSS and Open Redirect Affected: < 0.6.62 |
| CVE-2026-26020 | 8.8 | Feb 12 | AutoGPT Affected by Remote Code Execution via Dynamic Module Import in Block Loading (__import__) Affected: < 0.6.48 |
| CVE-2026-24780 | 8.8 | Jan 29 | AutoGPT is Vulnerable to RCE via Disabled Block Execution Affected: >= 0.1.0, < 0.6.44 |
| CVE-2025-32437 | 8.7 | Jun 18 | AutoGPT has a DoS vulnerability in MediaDurationBlock Affected: < 0.6.63 |
| CVE-2025-32424 | 8.7 | Jun 18 | AutoGPT has a DoS vulnerability in ScreenshotWebPageBlock Affected: < 0.6.63 |
| CVE-2025-32422 | 8.7 | Jun 18 | AutoGPT has a DoS vulnerability in FileStoreBlock with StepThroughItemsBlock Affected: < 0.6.63 |
| CVE-2025-32392 | 8.7 | Jun 18 | AutoGPT has a DoS vulnerability in LoopVideoBlock Affected: < 0.6.63 |
| CVE-2025-31491 | 8.6 | Apr 14 | AutoGPT allows leakage of cross-domain cookies and protected headers in requests redirect Affected: < 0.6.1 |
| CVE-2026-56663 | 8.5 | Jun 26 | AutoGPT: SSRF-to-RCE Chain in `SendWebRequestBlock` via IP validation bypass and internal `pg-meta` access Affected: < 0.6.52 |
| CVE-2026-72922 | 8.2 | Aug 11 | AutoGPT: Webhook provider path confusion bypasses generic webhook secret verification Affected: < 0.6.70 |
| CVE-2026-22038 | 8.1 | Feb 4 | AutoGPT's API Keys and Secrets Logged in Plaintext in Stagehand Integration Blocks Affected: < autogpt-platform-beta-v0.6.46 |
| CVE-2026-33235 | 7.7 | Jun 24 | AutoGPT: Denial of Service (DoS) via Resource Exhaustion in text templating features Affected: >= 0.1.0, < 0.6.52 |
| CVE-2025-53944 | 7.7 | Jul 30 | AutoGPT Platform Exposes Graph Execution Results via Authorization Gap Affected: < 0.6.16 |
| CVE-2026-33233 | 7.6 | May 19 | AutoGPT Platform: Remote Code Execution via Unsafe Pickle Deserialization of Redis Cache Entries Affected: >= 0.6.34, < 0.6.52 |
| CVE-2026-33232 | 7.5 | May 19 | AutoGPT: Unauthenticated DoS via Disk Space Exhaustion Affected: >= 0.4.2, < 0.6.52 |
| CVE-2025-31490 | 7.5 | Apr 14 | AutoGPT allows SSRF due to DNS Rebinding in requests wrapper Affected: < 0.6.1 |
| CVE-2025-32436 | 7.1 | Jun 18 | AutoGPT has a DoS vulnerability in AddAudioToVideoBlock Affected: < 0.6.63 |
| CVE-2026-30950 | 7.1 | May 18 | AutoGPT has Authenticated Session Hijacking via IDOR Affected: >= 0.6.36, < 0.6.51 |
| CVE-2026-26006 | 6.5 | Feb 10 | Redos (Regular Expression Denial of Service) at Code Extraction Block in significant-gravitas/autogpt Affected: >= 0.4.0, < 0.6.32 |
| CVE-2025-32393 | 6.5 | Feb 5 | AutoGPT has a DoS vulnerability in ReadRSSFeedBlock Affected: < autogpt-platform-beta-v0.6.32 |
| CVE-2025-32425 | 5.5 | May 13 | AutoGPT has missing Docker log rotation on platform containers that allows host disk-exhaustion DoS Affected: < 0.6.32 |
| CVE-2026-56823 | 5.4 | Jun 26 | AutoGPT: IDOR in Webhook Ping Endpoint Allows Enumeration and Cross-User Ping Triggering Affected: < 0.6.64 |
| CVE-2026-45023 | 5.4 | May 28 | AutoGPT: Credit system bypassed via direct block execution in POST /api/blocks/{block_id}/execute Affected: < 0.6.59 |
| CVE-2025-32394 | 5.3 | Jun 26 | AutoGPT: There is a DoS vulnerability in AITextSummarizerBlock Affected: < 0.6.32 |
| CVE-2025-32423 | 5.3 | Jun 26 | AutoGPT: There is a DoS vulnerability in ExtractTextInformationBlock Affected: < 0.6.32 |
| CVE-2026-33234 | 5.0 | May 19 | AutoGPT: SendEmailBlock's IP blocklist bypass allows SSRF via user-controlled SMTP server Affected: >= 0.1.0, < 0.6.52 |
| CVE-2025-31494 | 3.5 | Apr 14 | AutoGPT allows cross-user sharing of node execution results through WebSockets API Affected: < 0.6.1 |
Showing 29