These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability in the Apify MCP server allows a malicious Actor publisher to redirect connectMCPClient to a third-party host, exposing the Apify API token and enabling access to Actors, stored data, and billable compute. This issue is fixed in version 0.10.11. The vulnerability arises from the server's failure to verify the origin of the webServerMcpPath from an Actor definition, which can be exploited b [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-16T18:16:43.913Z and has not been modified since then. The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.9.21, the fetch-apify-docs tool in src/tools/common/fetch_apify_docs.ts valid [truncated]
Crawlee, a web scraping and browser automation library, is vulnerable to SSRF via sitemap-derived URLs from version 1.0.0 to before version 1.7.0. This issue is patched in version 1.7.0.