scrapy vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 20221
3. 20244
4. 20251
5. 20263

Newest CVEs

• CVE-2026-105782

  Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware

  scrapy · scrapy

  High7.5
• CVE-2026-84366

  Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default

  scrapy · scrapy

  High7.4
• CVE-2026-55520

  Protego: Exponential backtracking ReDoS in robots.txt URL wildcard matching

  scrapy · protego

  High7.1
• CVE-2025-6176

  Brotli decompression bomb DoS in scrapy/scrapy

  scrapy · scrapy/scrapy

  High7.5
• CVE-2024-1968

  Authorization Header Leakage in scrapy/scrapy on Scheme Change Redirects

  scrapy · scrapy/scrapy

  High7.5
• CVE-2024-3574

  Authorization Header Leak During Cross-Domain Redirect in scrapy/scrapy

  scrapy · scrapy/scrapy

  High7.5
• CVE-2024-3572

  XML External Entity (XXE) Vulnerability in scrapy/scrapy

  scrapy · scrapy/scrapy

  High7.5
• CVE-2024-1892

  ReDoS Vulnerability in scrapy/scrapy's XMLFeedSpider

  scrapy · scrapy/scrapy

  High7.5
• CVE-2022-0577

  Exposure of Sensitive Information to an Unauthorized Actor in scrapy/scrapy

  scrapy · scrapy/scrapy

  High8.8
• CVE-2021-41125

  HTTP authentication credential leak to target websites in scrapy

  scrapy · scrapy

  Medium5.7