CVE-2026-46497
📛 CVE Title
(no title)
Description
Crawlee for Python: SSRF via sitemap-derived URLs
Description (MITRE) cveawg.mitre.org
Pulled from cveawg.mitre.org/api/cve/CVE-2026-46497 on 2026-07-28. Shown when MITRE's text differs from the cvelistV5 mirror.
Crawlee is a web scraping and browser automation library. From version 1.0.0 to before version 1.7.0, Crawlee is vulnerable to SSRF via sitemap-derived URLs. This issue has been patched in version 1.7.0.
Overview
- State
- —
- Assigner (CNA)
- —
- CVSS severity
- critical
- CVSS score
- 9.1 / 10
- CVSS vector
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N- Effective score
- 9.1 / 10 CRITICAL source: CNA overview
- CWE(s)
- —
- Reserved
- —
- Published
- —
- Last updated
- —
- Source
- https://www.tenable.com/cve/CVE-2026-46497
- Linked Threat
- CVE-2026-46497 — CVE-2026-46497
NVD / KEV / EPSS data refreshed 2026-05-25 00:15 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-36067 - Assigner
- GitHub_M
- Published
- Jun 10, 2026, 3:51:15 PM
- Updated
- Jun 10, 2026, 6:19:35 PM
- EUVD base score (CVSS 4.0)
-
2.3 / 10
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N - EUVD-reported EPSS
- 0.2900
- Vendors
- apify
- Products
-
crawlee-python (1.0.0, < 1.7.0)
- Aliases
-
GHSA-3r75-xc34-5f44
ENISA description: Crawlee is a web scraping and browser automation library. From version 1.0.0 to before version 1.7.0, Crawlee is vulnerable to SSRF via sitemap-derived URLs. This issue has been patched in version 1.7.0.
Vendor references (0)
References embedded in the original CVE record by the assigning CNA.
None in the CVE record.
MITRE references (2) cveawg.mitre.org
Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.
- https://github.com/apify/crawlee-python/releases/tag/v1.7.0 x_refsource_MISC
- https://github.com/apify/crawlee-python/security/advisories/GHSA-3r75-xc34-5f44 x_refsource_CONFIRM
Web references (2)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- https://nvd.nist.gov/vuln/detail/CVE-2026-46497 tenable:nvd.nist.gov
- https://www.cve.org/CVERecord?id=CVE-2026-46497 tenable:www.cve.org
Remediations (10)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:4sysops.com
Starting in April 2026 , Windows updates will change the default Kerberos ticket issuance behavior to AES-SHA1 for accounts without explicit encryption settings, while RC4 can still be used where explicitly enabled. This change, driven by CVE - 2026 -20833, affects every Windows Server environment where service accounts or devices still rely on RC4. Any service account, NAS device, or legacy ...
2026-05-26 03:00 UTC -
web:chromereleases.googleblog.com
Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix . We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven't yet fixed. This update includes 21 security fixes. Please see the Chrome Security Page for more information.
2026-05-26 03:00 UTC -
web:community.ui.com
Published: May 21, 2026 Updated: May 22, 2026 Version: 1.1 Revision: 1.1 Summary 1 of 5 A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection. Affected Products: UniFi OS Server (Version 5.0.6 and earlier) Mitigation : Update your UniFi OS Server to Version 5.0.8 or later ...
2026-05-26 03:00 UTC -
web:cyberpress.org
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited Microsoft Defender vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, issuing an urgent remediation directive for federal agencies with a due date of June 3, 2026 .
2026-05-26 03:00 UTC -
web:guide.sonatype.com
Technical security analysis for CVE-2026-46497 . CVSS 2.3 severity. View CVSS vectors, CWE classifications, and exploit maturity ratings.
2026-05-26 03:00 UTC -
web:source.android.com
This Section contains the available Android Security Bulletins, which provide fixes for possible issues affecting Android devices.
2026-05-26 03:00 UTC -
web:support.microsoft.com
The following summary outlines key issues addressed by this update. The bold text within the brackets indicates the item or area of the change. [Networking] Fixed: This update addresses a security issue in the Windows Routing and Remote Access Service (RRAS) management tool. If you connect to a malicious remote server, an attacker could disrupt the tool or run code on your device. For more ...
2026-05-26 03:00 UTC -
web:www.oracle.com
This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.
2026-05-26 03:00 UTC -
web:www.windowslatest.com
Windows 11 April 2026 update adds Narrator Copilot support, faster Settings, File Explorer fixes, and key security improvements.
2026-05-26 03:00 UTC -
web:zecurit.com
Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .
2026-05-26 03:00 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.