Known vulnerabilities in scrapy

Vendor: scrapy.org
Software: scrapy
Software CPE: cpe:2.3:a:scrapy.org:py3-scrapy:*:*:*:*:*:*:*:*
Total vulnerabilities: 14
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.2

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting scrapy scrapy is affected by 14 known vulnerabilities: 12 medium, 2 low Critical High Medium Low

Vulnerabilities (14)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU137025 - Cleartext Transmission of Sensitive Information
CWE-319 Medium
No
No
2.17.0 07.07.2026 SB2026070765
#VU127080 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CWE-470 Medium
No
No
2.14.2 23.04.2026 SB20260423132
#VU118560 - Resource exhaustion
CVE-2025-6176
CWE-400 Medium
No
No
2.13.3 17.11.2025 SB2025111748
SB2025111750
SB2025111755
and 28 more
#VU127071 - Files or Directories Accessible to External Parties
CWE-552 Low
No
No
2.11.2 14.05.2024 SB2024051470
#VU127070 - Unintended Proxy or Intermediary ('Confused Deputy')
CWE-441 Low
No
No
2.11.2 14.05.2024 SB2024051470
#VU127069 - Exposure of sensitive information to an unauthorized actor
CWE-200 Medium
No
No
2.11.2 14.05.2024 SB2024051470
#VU127075 - Exposure of sensitive information to an unauthorized actor
CWE-200 Medium
No
No
1.8.4, 2.11.1 14.02.2024 SB2024021456
#VU127074 - Improper Handling of Highly Compressed Data (Data Amplification)
CWE-409 Medium
No
No
1.8.4, 2.0.0, 2.11.1 14.02.2024 SB2024021456
#VU127072 - Inefficient Regular Expression Complexity
CWE-1333 Medium
No
No
1.8.4, 2.11.1 14.02.2024 SB2024021456
#VU127073 - Inefficient Regular Expression Complexity
CWE-1333 Medium
No
No
1.8.4, 2.11.1 14.02.2024 SB2024021456
#VU127076 - Exposure of sensitive information to an unauthorized actor
CWE-200 Medium
No
No
1.8.3, 2.6.2 25.07.2022 SB2022072567
#VU127077 - Origin Validation Error
CWE-346 Medium
No
No
1.8.2, 2.6.0 01.03.2022 SB2022030140
#VU127078 - Exposure of sensitive information to an unauthorized actor
CVE-2022-0577
CWE-200 Medium
No
No
1.8.2, 2.6.0 01.03.2022 SB2022030140
#VU127079 - Improper Access Control
CVE-2021-41125
CWE-284 Medium
No
No
1.8.1, 2.5.1 06.10.2021 SB2021100637