Login Request a demo
ST
Product
strapi
by strapi · last CVE Oct 10, 2026
On CISA KEVExploited in the wild
41
CVEs
1
On KEV
9.8
Max CVSS
1
New 30D
Vulnerabilities41In the news2Timeline
Severity mix
Critical 4High 20Medium 15Low 2
Severity
All severities41Critical4High20Medium15Low2
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add strapi to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2023-22894
In wildKEV
4.9
4%
Apr 19
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter
Affected: 3.2.1 before 4.8.0
CVE-2022-0764
6.7
1%
Feb 26
Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0
Affected: before 4.1.0
CVE-2026-22706
6.5
0%
May 14
Strapi: Password Reset Does Not Revoke Existing Refresh Sessions
Affected: < 5.33.3
CVE-2025-53092
6.5
0%
Oct 16
Strapi is an open source headless content management system
Affected: before 5.20.0
CVE-2024-31217
6.5
1%
Jun 12
Strapi is an open-source content management system
Affected: before 4.22.0
CVE-2020-13961
6.5
2%
Jun 19
Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global variable without any sanitation
Affected: before 3.0.2
CVE-2023-36472
5.7
1%
Sep 15
Strapi is an open-source headless content management system
Affected: before 4.11.7
CVE-2026-57997
5.4
0%
Jun 29
Strapi users-permissions - JWT Algorithm Confusion via Missing Algorithm Configuration
Affected: before 5.7.0
CVE-2026-22707
5.4
0%
May 14
Strapi Upload Plugin MIME Validation Bypass via Content API
Affected: < 5.33.3
CVE-2020-27666
5.4
1%
Oct 22
Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature
Affected: before 3.2.5
CVE-2025-64526
5.3
0%
May 14
Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying
Affected: < 5.45.0
CVE-2025-25298
5.3
0%
Oct 16
Strapi is an open source headless CMS
Affected: before 5.10.3
CVE-2020-8123
4.9
1%
Feb 4
A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application
Affected: before 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +34 more
CVE-2022-29894
4.8
1%
Jun 13
Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function
Affected: through 3.6.10
CVE-2026-108114
4.3
0%
Oct 10
Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions
Affected: 5.47.0 through 5.57.0
Showing 15