Strapi Strapi

• CVE-2026-108114 Medium 4.3 Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions 0.2%
• CVE-2026-90561 High 8.7 Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG 0.4%
• CVE-2026-57997 Medium 4.8 Strapi users-permissions - JWT Algorithm Confusion via Missing Algorithm Configuration 0.2%
• CVE-2026-27886 Critical 9.2 Strapi may leak sensitive data via relational filtering due to lack of query sanitization 1.9%
• CVE-2026-22707 Medium 5.3 Strapi Upload Plugin MIME Validation Bypass via Content API 0.2%
• CVE-2026-22706 Low 2.1 Strapi: Password Reset Does Not Revoke Existing Refresh Sessions 0.3%
• CVE-2026-22599 Critical 9.3 Strapi Vulnerable to SQL Injection in Content Type Builder 1.2%
• CVE-2025-64526 Medium 6.9 Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying 0.5%
• CVE-2025-53092 Medium 6.5 Strapi core vulnerable to sensitive data exposure via CORS misconfiguration 0.3%
• CVE-2025-25298 Medium 6.3 Missing Maximum Password Length Validation in Strapi Password Hashing 0.4%
• CVE-2024-56143 High 8.2 Strapi Allows Unauthorized Access to Private Fields via parms.lookup 0.4%
• CVE-2025-3930 Medium 6.3 Lack of JWT Expiration after Log Out in Strapi 0.7%
• CVE-2024-52588 Medium 4.9 Strapi allows Server-Side Request Forgery in Webhook function 0.6%
• CVE-2024-34065 High 7.1 @strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass 0.7%
• CVE-2024-31217 Medium 5.3 @strapi/plugin-upload has a Denial-of-Service via Improper Exception Handling 0.7%
• CVE-2024-29181 Low 2.3 @strapi/plugin-content-manager leaks data via relations via the Admin Panel 0.4%
• CVE-2023-39345 High 7.6 Unauthorized Access to Private Fields in User Registration API in strapi 0.6%
• CVE-2023-38507 High 7.3 Strapi Improper Rate Limiting vulnerability 1.0%
• CVE-2023-37263 Medium 6.8 Strapi's field level permissions not being respected in relationship title 0.6%
• CVE-2023-36472 Medium 5.8 Strapi may leak sensitive user information, user reset password, tokens via content-manager views 0.7%
• CVE-2023-34235 High 8.6 Leaking sensitive user information still possible by filtering on private with prefix fields 1.1%
• CVE-2023-34093 Medium 4.8 Strapi allows actors to make all attributes on a content-type public without noticing it 0.7%
• CVE-2022-29894 Unrated Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. By exploiting this vulnerability, an arbitrary script may be executed on the web browser 0.8%
• CVE-2022-30618 Unrated An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible to the authenticated 1.0%
• CVE-2022-30617 Unrated An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a relationship (e.g., cr 1.5%