strapi vulnerabilities
29 published CVEs name strapi among the affected products.
- 29Published CVEs29 of them scored
- 11Last 12 monthspublished in the last year
- 4Critical7 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-118171
CVE-2026-118171
Strapi · Strapi Open Source and Enterprise Headless CMS
Medium6.5 - CVE-2026-118172
CVE-2026-118172
Strapi · Strapi Open Source and Enterprise Headless CMS
Medium6.1 - CVE-2026-118170
CVE-2026-118170
Strapi · Strapi Open Source and Enterprise Headless CMS
Critical9.1 - CVE-2026-108114
Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions
strapi · strapi
Medium5.3 - CVE-2026-90561
Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG
strapi · strapi
Critical9.3 - CVE-2026-57997
Strapi users-permissions - JWT Algorithm Confusion via Missing Algorithm Configuration
strapi · strapi
Medium6.3 - CVE-2026-27886
Strapi may leak sensitive data via relational filtering due to lack of query sanitization
strapi · strapi
Critical9.2 - CVE-2026-22707
Strapi Upload Plugin MIME Validation Bypass via Content API
strapi · strapi
Medium5.3 - CVE-2026-22706
Strapi: Password Reset Does Not Revoke Existing Refresh Sessions
strapi · strapi
Low2.1 - CVE-2026-22599
Strapi Vulnerable to SQL Injection in Content Type Builder
strapi · strapi
Critical9.3