Login Request a demo
ST
Product
strapi
by strapi · last CVE Oct 10, 2026
On CISA KEVExploited in the wild
41
CVEs
1
On KEV
9.8
Max CVSS
1
New 30D
Vulnerabilities41In the news2Timeline
Severity mix
Critical 4High 20Medium 15Low 2
Severity
All severities41Critical4High20Medium15Low2
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add strapi to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2023-38507
9.8
1%
Sep 15
Strapi is the an open-source headless content management system
Affected: before 4.12.1
CVE-2022-27263
9.8
3%
Apr 12
An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file
Affected: 4.1.5
CVE-2020-27664
9.8
2%
Oct 22
admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality
Affected: before 3.2.5
CVE-2019-18818
9.8
98%
Nov 7
strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js
Affected: through 1.6.4; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +34 more
Showing 4