apify

Records4All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

apify records in CISA KEV

No apify vulnerabilities are listed in CISA KEV.

Records

4 records

TI-2026-36913 CVE-2026-50143 · GHSA-6gr2-qh89-hxwm

Actor MCP path authority injection leaks Apify token

HIGH 70

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00488 Published 2026-08-18 Fixed in 0.10.11 CWE-918

TI-2026-34061 CVE-2026-46341 · GHSA-jwp7-wg77-3w9v

Apify MCP server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching

MEDIUM 60

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00234 Published 2026-07-16 Fixed in 0.9.21 CWE-183

TI-2026-56055 CVE-2026-81093 · GHSA-gghj-77w7-6r3h

Apify Actors MCP Server before 0.9.12 Server-Side Request Forgery via get-html-skeleton

MEDIUM 44

The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00524 Published 2026-08-27 Fixed in 0.9.12 CWE-918

TI-2026-34195 CVE-2026-46497 · GHSA-3r75-xc34-5f44

SSRF via sitemap-derived URLs in Crawlee for Python

LOW 12

Crawlee is a web scraping and browser automation library.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00286 Published 2026-06-10 Fixed in 1.7.0 CWE-918

Open these records in search →

Critical	0
High	2
Medium	1
Low	1
No CVSS	0