Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
PYSEC-2026-3918
  • PyPI/scrapy
 Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default 10 Sep
  • Fix available
  • Severity - 7.4 (High)
GHSA-76g3-c3x4-crvx
  • PyPI/scrapy
 Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default 02 Sep
  • Fix available
  • Severity - 7.4 (High)
PYSEC-2026-1906
  • PyPI/scrapy
 Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation 07 Jul
  • Fix available
  • Severity - 7.5 (High)
PYSEC-2026-1907
  • PyPI/scrapy
 Scrapy decompression bomb vulnerability 07 Jul
  • Fix available
  • Severity - 7.5 (High)
PYSEC-2026-1908
  • PyPI/scrapy
 Scrapy authorization header leakage on cross-domain redirect 07 Jul
  • Fix available
  • Severity - 7.5 (High)
GHSA-cwxj-rr6w-m6w7
  • PyPI/scrapy
 Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware 13 Mar
  • Fix available
  • Severity - 7.5 (High)
GHSA-2qfp-q593-8484
  • PyPI/brotli
  • PyPI/scrapy
 Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation 31 Oct 2025
  • Fix available
  • Severity - 7.5 (High)
PYSEC-2024-258
  • PyPI/scrapy
  • github.com/scrapy/scrapy
 See record for full details 20 May 2024
  • Fix available
GHSA-23j4-mw76-5v7h
  • PyPI/scrapy
 Scrapy allows redirect following in protocols other than HTTP 14 May 2024
  • Fix available
  • Severity - 6.5 (Medium)
GHSA-jm3v-qxmh-hxwv
  • PyPI/scrapy
 Scrapy's redirects ignoring scheme-specific proxy settings 14 May 2024
  • Fix available
  • Severity - 4.3 (Medium)
GHSA-4qqq-9vqf-3h3f
  • PyPI/scrapy
 Scrapy leaks the authorization header on same-domain but cross-origin redirects 14 May 2024
  • Fix available
  • Severity - 5.9 (Medium)
PYSEC-2024-162
  • PyPI/scrapy
  • github.com/scrapy/scrapy
 See record for full details 28 Feb 2024
  • Fix available
  • Severity - 6.5 (Medium)
GHSA-7j7m-v7m3-jqm7
  • PyPI/scrapy
 Scrapy decompression bomb vulnerability 16 Feb 2024
  • Fix available
  • Severity - 7.5 (High)
GHSA-cw9j-q3vf-hrrv
  • PyPI/scrapy
 Scrapy authorization header leakage on cross-domain redirect 15 Feb 2024
  • Fix available
  • Severity - 7.5 (High)
GHSA-cc65-xxvf-f7r9
  • PyPI/scrapy
 Scrapy vulnerable to ReDoS via XMLFeedSpider 15 Feb 2024
  • Fix available
  • Severity - 7.5 (High)
GHSA-9x8m-2xpf-crp3
  • PyPI/scrapy
 Scrapy before 2.6.2 and 1.8.3 vulnerable to one proxy sending credentials to another 29 Jul 2022
  • Fix available
Load more...