SO
Product
Strapi Open Source and Enterprise Headless CMS
3
CVEs
0
On KEV
–
Max CVSS
3
New 30D
Severity mix
Critical 0High 0Medium 0Low 0
Watch
Add Strapi Open Source and Enterprise Headless CMS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-118171 New | – | Oct 27 | The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint Affected: 5.51.0 |
| CVE-2026-118172 New | – | Oct 27 | The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect Affected: 5.51.0 |
| CVE-2026-118170 New | – | Oct 27 | The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights… Affected: 5.51.0 |
Showing 3