High
CVE-2026-84366
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 15
Reset filters
High
CVE-2025-6176
Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation
High
CVE-2024-3572
Scrapy decompression bomb vulnerability
High
CVE-2024-3574
Scrapy authorization header leakage on cross-domain redirect
High
CVE-2026-105782
Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware
Medium
ghsa-23j4-mw76-5v7h
Scrapy allows redirect following in protocols other than HTTP
Medium
ghsa-jm3v-qxmh-hxwv
Scrapy's redirects ignoring scheme-specific proxy settings
Medium
CVE-2024-1968
In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme (e.g., HTTPS to HTTP) but remain within the same domain. This behav
Medium
CVE-2024-1892
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML conte
Medium
ghsa-9x8m-2xpf-crp3
Scrapy before 2.6.2 and 1.8.3 vulnerable to one proxy sending credentials to another
Medium
CVE-2022-0577
Incorrect Authorization and Exposure of Sensitive Information to an Unauthorized Actor in scrapy
Medium
ghsa-mfjm-vh54-3f96
Scrapy cookie-setting is not restricted based on the public suffix list
Medium
CVE-2021-41125
Scrapy HTTP authentication credentials potentially leaked to target websites
High
CVE-2021-41124
Splash authentication credentials potentially leaked to target websites
High
CVE-2017-14158
Scrapy denial of service vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.