ST
Vendor
strapi
50
CVEs
1
On KEV
4
New 30D
Products
ST9.8
strapi
strapi
41 CVEs1 on KEV1 new
SO–
Strapi Open Source and Enterprise Headless CMS
Strapi
3 CVEs0 on KEV3 new
ST6.5
@strapi/plugin-users-permissions
strapi
2 CVEs0 on KEV0 new
PP5.3
Protected Populate
Strapi
1 CVEs0 on KEV0 new
ST6.5
@strapi/admin
strapi
1 CVEs0 on KEV0 new
ST7.2
@strapi/content-type-builder
strapi
1 CVEs0 on KEV0 new
ST5.4
@strapi/upload
strapi
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-118171 New | SO Strapi Open Source and Enterprise Headless CMS Strapi | – | Oct 27 | The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint |
| CVE-2026-118172 New | SO Strapi Open Source and Enterprise Headless CMS Strapi | – | Oct 27 | The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect |
| CVE-2026-118170 New | SO Strapi Open Source and Enterprise Headless CMS Strapi | – | Oct 27 | The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights… |
| CVE-2026-108114 | ST strapi strapi | 4.3 | Oct 10 | Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions |
| CVE-2026-90561 | ST strapi strapi | 8.7 | Sep 13 | Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG |
| CVE-2026-57997 | ST strapi strapi | 5.4 | Jun 29 | Strapi users-permissions - JWT Algorithm Confusion via Missing Algorithm Configuration |
| CVE-2026-27886 | ST strapi strapi | 7.5 | May 14 | Strapi may leak sensitive data via relational filtering due to lack of query sanitization |
| CVE-2026-22707 | ST strapi strapi | 5.4 | May 14 | Strapi Upload Plugin MIME Validation Bypass via Content API |
| CVE-2026-22706 | ST @strapi/admin strapi | 6.5 | May 14 | Strapi: Password Reset Does Not Revoke Existing Refresh Sessions |
| CVE-2026-22599 | ST @strapi/content-type-builder strapi | 7.2 | May 14 | Strapi Vulnerable to SQL Injection in Content Type Builder |
| CVE-2025-64526 | ST @strapi/plugin-users-permissions strapi | 5.3 | May 14 | Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying |
| CVE-2025-53092 | ST Strapi Strapi | 6.5 | Oct 16 | Strapi is an open source headless content management system |
| CVE-2025-25298 | ST Strapi Strapi | 5.3 | Oct 16 | Strapi is an open source headless CMS |
| CVE-2024-56143 | ST Strapi Strapi | 8.2 | Oct 16 | Strapi is an open-source headless content management system |
| CVE-2024-52588 | ST Strapi Strapi | 7.5 | May 29 | Strapi is an open-source content management system |
| CVE-2024-37818 | ST Strapi Strapi | 8.6 | Jun 20 | Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image |
| CVE-2024-34065 | ST Strapi Strapi | 8.1 | Jun 12 | Strapi is an open-source content management system |
| CVE-2024-31217 | ST Strapi Strapi | 6.5 | Jun 12 | Strapi is an open-source content management system |
| CVE-2024-29181 | ST Strapi Strapi | 3.5 | Jun 12 | Strapi is an open-source content management system |
| CVE-2023-48218 | PP Protected Populate Strapi | 5.3 | Nov 20 | The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information |
| CVE-2023-39345 | ST Strapi Strapi | 7.5 | Nov 6 | strapi is an open-source headless CMS |
| CVE-2023-38507 | ST Strapi Strapi | 9.8 | Sep 15 | Strapi is the an open-source headless content management system |
| CVE-2023-37263 | ST Strapi Strapi | 2.7 | Sep 15 | Strapi is the an open-source headless content management system |
| CVE-2023-36472 | ST Strapi Strapi | 5.7 | Sep 15 | Strapi is an open-source headless content management system |
| CVE-2023-34235 | ST Strapi Strapi | 7.5 | Jul 25 | Strapi is an open-source headless content management system |
| CVE-2023-34093 | ST Strapi Strapi | 7.1 | Jul 25 | Strapi is an open-source headless content management system |
| CVE-2023-22893 | ST Strapi Strapi | 7.5 | Apr 19 | Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication |
| CVE-2023-22621 | ST Strapi Strapi | 7.2 | Apr 19 | Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server |
| CVE-2023-22894 In wildKEV | ST Strapi Strapi | 4.9 | Apr 19 | Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter |
| CVE-2022-31367 | ST Strapi Strapi | 8.8 | Sep 27 | Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses |
| CVE-2022-32114 | ST Strapi Strapi | 8.8 | Jul 13 | An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file |
| CVE-2022-29894 | ST Strapi Strapi | 4.8 | Jun 13 | Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function |
| CVE-2022-30618 | ST Strapi Strapi | 7.5 | May 19 | An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible… |
| CVE-2022-30617 | ST Strapi Strapi | 8.8 | May 19 | An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a… |
| CVE-2021-46440 | ST Strapi Strapi | 7.5 | May 3 | Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a victim's HTTP request,… |
| CVE-2022-27263 | ST Strapi Strapi | 9.8 | Apr 12 | An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file |
| CVE-2022-0764 | ST Strapi Strapi | 6.7 | Feb 26 | Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0 |
| CVE-2021-28128 | ST Strapi Strapi | 8.1 | May 6 | In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password |
| CVE-2020-27666 | ST Strapi Strapi | 5.4 | Oct 22 | Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature |
| CVE-2020-27665 | ST Strapi Strapi | 7.5 | Oct 22 | In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB (aka content-type-builder) routes |
| CVE-2020-27664 | ST Strapi Strapi | 9.8 | Oct 22 | admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality |
| CVE-2020-13961 | ST Strapi Strapi | 6.5 | Jun 19 | Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global variable without any sanitation |
| CVE-2020-8123 | ST Strapi Strapi | 4.9 | Feb 4 | A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application |
| CVE-2019-19609 | ST Strapi Strapi | 7.2 | Dec 5 | The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize… |
| CVE-2019-18818 | ST Strapi Strapi | 9.8 | Nov 7 | strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js |