apify
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| apify-mcp-server | 2 | – | Aug 18, 2026 |
| actors-mcp-server | 1 | – | Aug 27, 2026 |
| crawlee-python | 1 | – | Jun 10, 2026 |
Exploited and recent CVEs
- CVE-2026-81093 Apify Actors MCP Server before 0.9.12 Server-Side Request Forgery via get-html-skeleton 0.5%
- CVE-2026-50143 Actor MCP path authority injection leaks Apify token 0.5%
- CVE-2026-46341 Apify MCP server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching 0.2%
- CVE-2026-46497 SSRF via sitemap-derived URLs in Crawlee for Python 0.3%