CVE Tools
Track your stack

Crawl4ai

39 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Crawl4ai, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Crawl4ai CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Crawl4ai CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-041
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-022
2026-030
2026-040
2026-050
2026-0615
2026-076
2026-080
2026-095
2026-1010

Severity

How the 39 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical721%
  • High1648%
  • Medium1030%

Latest CVEs

The 15 most recently published vulnerabilities affecting Crawl4ai.

  1. CVE-2026-119122Crawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check5.3
  2. CVE-2026-119121Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for4.3
  3. CVE-2026-119120Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name7.5
  4. CVE-2026-119119Crawl4AI before 0.9.5 Denial of Service via Unbounded CrawlerRunConfig Delay Fields7.5
  5. CVE-2026-119118Crawl4AI before 0.9.5 Improper Certificate Validation via Hard-coded Chromium Flags6.5
  6. CVE-2026-115508Crawl4AI 0.7.0 before 0.9.5 ReDoS via /crawl Regex Fields6.5
  7. CVE-2026-112363Crawl4AI 0.8.7 through 0.9.5 SSRF Bypass via SSLCertificate.from_url URL Userinfo5.3
  8. CVE-2026-109239Crawl4AI before 0.9.4 Blind SSRF via RobotsParser.can_fetch robots.txt Fetch5.3
  9. CVE-2026-109238Crawl4AI 0.7.0 before 0.9.4 SSRF via link_preview_config URL Seeder8.6
  10. CVE-2026-109237Crawl4AI 0.9.0 before 0.9.4 Untrusted Config Gate Bypass Leaks Environment Variables8.1
  11. CVE-2026-91943Crawl4AI before 0.9.3 SSRF via PDFContentScrapingStrategy7.7
  12. CVE-2026-91944crawl4ai before 0.9.3 DOM-based XSS via Playground UI6.1
  13. CVE-2026-91942crawl4ai before 0.9.3 Cross-Site Scripting via innerHTML5.4
  14. CVE-2026-91941Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy7.5
  15. CVE-2026-91940crawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategy7.5

Product grouping is registry-driven, with AI assist and human review. How it works