Log in Start free

Strapi

Products

ProductCVEsExploitedLatest
Strapi25–Oct 10, 2026
Strapi Open Source and Enterprise Headless CMS3–Oct 27, 2026
@strapi/plugin-users-permissions2–May 14, 2026
@strapi/upload1–May 14, 2026
@strapi/content-type-builder1–May 14, 2026
@strapi/admin1–May 14, 2026
strapi/strapi1–Feb 26, 2022

Exploited and recent CVEs

  • CVE-2026-118171 Medium 6.5 CVE-2026-118171 0.2%
  • CVE-2026-118172 Medium 6.1 CVE-2026-118172 0.2%
  • CVE-2026-118170 Critical 9.1 CVE-2026-118170 0.3%
  • CVE-2026-108114 Medium 4.3 Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions 0.2%
  • CVE-2026-90561 High 8.7 Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG 0.4%
  • CVE-2026-57997 Medium 4.8 Strapi users-permissions - JWT Algorithm Confusion via Missing Algorithm Configuration 0.2%
  • CVE-2026-27886 Critical 9.2 Strapi may leak sensitive data via relational filtering due to lack of query sanitization 1.9%
  • CVE-2026-22707 Medium 5.3 Strapi Upload Plugin MIME Validation Bypass via Content API 0.2%
  • CVE-2026-22707 Medium 5.3 Strapi Upload Plugin MIME Validation Bypass via Content API 0.2%
  • CVE-2026-22706 Low 2.1 Strapi: Password Reset Does Not Revoke Existing Refresh Sessions 0.3%
  • CVE-2026-22706 Low 2.1 Strapi: Password Reset Does Not Revoke Existing Refresh Sessions 0.3%
  • CVE-2026-22706 Low 2.1 Strapi: Password Reset Does Not Revoke Existing Refresh Sessions 0.3%
  • CVE-2026-22599 Critical 9.3 Strapi Vulnerable to SQL Injection in Content Type Builder 1.2%
  • CVE-2026-22599 Critical 9.3 Strapi Vulnerable to SQL Injection in Content Type Builder 1.2%
  • CVE-2025-64526 Medium 6.9 Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying 0.5%
  • CVE-2025-64526 Medium 6.9 Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying 0.5%
  • CVE-2025-53092 Medium 6.5 Strapi core vulnerable to sensitive data exposure via CORS misconfiguration 0.3%
  • CVE-2025-25298 Medium 6.3 Missing Maximum Password Length Validation in Strapi Password Hashing 0.4%
  • CVE-2024-56143 High 8.2 Strapi Allows Unauthorized Access to Private Fields via parms.lookup 0.4%
  • CVE-2025-3930 Medium 6.3 Lack of JWT Expiration after Log Out in Strapi 0.7%
  • CVE-2024-52588 Medium 4.9 Strapi allows Server-Side Request Forgery in Webhook function 0.6%
  • CVE-2024-34065 High 7.1 @strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass 0.7%
  • CVE-2024-31217 Medium 5.3 @strapi/plugin-upload has a Denial-of-Service via Improper Exception Handling 0.7%
  • CVE-2024-29181 Low 2.3 @strapi/plugin-content-manager leaks data via relations via the Admin Panel 0.4%
  • CVE-2023-39345 High 7.6 Unauthorized Access to Private Fields in User Registration API in strapi 0.6%
  • CVE-2023-38507 High 7.3 Strapi Improper Rate Limiting vulnerability 1.0%
  • CVE-2023-37263 Medium 6.8 Strapi's field level permissions not being respected in relationship title 0.6%
  • CVE-2023-36472 Medium 5.8 Strapi may leak sensitive user information, user reset password, tokens via content-manager views 0.7%
  • CVE-2023-34235 High 8.6 Leaking sensitive user information still possible by filtering on private with prefix fields 1.1%
  • CVE-2023-34093 Medium 4.8 Strapi allows actors to make all attributes on a content-type public without noticing it 0.7%