Read the docs

firecrawl

Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

firecrawl records in CISA KEV

No firecrawl vulnerabilities are listed in CISA KEV.

Records

5 records

TI-2026-80146 CVE-2026-116066 · GHSA-xmmq-vp8j-m5qf

DNS rebinding bypasses SSRF checks in Firecrawl Playwright service

Priority MEDIUM 64

Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding.

CVSS 4.0HIGH 7.0 Network No auth No interaction EPSS 0.00277 Published 2026-10-25 Fixed in 2.11.586 CWE-918
TI-2026-58731 CVE-2026-85606 · GHSA-q267-2jg6-m7vc

firecrawl-mcp-server 3.20.2 Arbitrary Local File Read via filePath

Priority MEDIUM 45

firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_parse tool that accepts unconstrained filePath arguments without directory containment validation.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00897 Published 2026-09-04 No fix listed CWE-22
Open these records in search →