Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,273All CVEsplus 19,140 rejected
- 462Last 24 hours2,741 in the last 7 days
- 16,922Last 30 days1,555 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 4 | 0 | 6 | 1 | 0 | 11 | 29 |
| 2025 | 0 | 1 | 4 | 0 | 0 | 5 | 18 |
| 2024 | 0 | 1 | 1 | 1 | 0 | 3 | 13 |
| 2023 | 0 | 3 | 3 | 0 | 0 | 6 | 10 |
| 2022 | 0 | 2 | 2 | 0 | 0 | 4 | 4 |
| Title | ||
|---|---|---|
| CVE-2026-118171 | CVE-2026-118171Strapi · Strapi Open Source and Enterprise Headless CMS | Medium6.5 |
| CVE-2026-118172 | CVE-2026-118172Strapi · Strapi Open Source and Enterprise Headless CMS | Medium6.1 |
| CVE-2026-118170 | CVE-2026-118170Strapi · Strapi Open Source and Enterprise Headless CMS | Critical9.1 |
| CVE-2026-108114 | Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissionsstrapi · strapi | Medium5.3 |
| CVE-2026-90561 | Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYGstrapi · strapi | Critical9.3 |
| CVE-2026-57997 | Strapi users-permissions - JWT Algorithm Confusion via Missing Algorithm Configurationstrapi · strapi | Medium6.3 |
| CVE-2026-27886 | Strapi may leak sensitive data via relational filtering due to lack of query sanitizationstrapi · strapi | Critical9.2 |
| CVE-2026-22707 | Strapi Upload Plugin MIME Validation Bypass via Content APIstrapi · strapi | Medium5.3 |
| CVE-2026-22706 | Strapi: Password Reset Does Not Revoke Existing Refresh Sessionsstrapi · strapi | Low2.1 |
| CVE-2026-22599 | Strapi Vulnerable to SQL Injection in Content Type Builderstrapi · strapi | Critical9.3 |
| CVE-2025-64526 | Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keyingstrapi · strapi | Medium6.9 |
| CVE-2025-53092 | Strapi core vulnerable to sensitive data exposure via CORS misconfigurationstrapi · strapi | Medium6.5 |
| CVE-2025-25298 | Missing Maximum Password Length Validation in Strapi Password Hashingstrapi · strapi | Medium6.3 |
| CVE-2024-56143 | Strapi Allows Unauthorized Access to Private Fields via parms.lookupstrapi · strapi | High8.2 |
| CVE-2025-3930 | Lack of JWT Expiration after Log Out in StrapiStrapi · Strapi | Medium6.3 |
| CVE-2024-52588 | Strapi allows Server-Side Request Forgery in Webhook functionstrapi · strapi | Medium4.9 |
| CVE-2024-34065 | @strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypassstrapi · strapi | High7.1 |
| CVE-2024-31217 | @strapi/plugin-upload has a Denial-of-Service via Improper Exception Handlingstrapi · strapi | Medium5.3 |
| CVE-2024-29181 | @strapi/plugin-content-manager leaks data via relations via the Admin Panelstrapi · strapi | Low2.3 |
| CVE-2023-39345 | Unauthorized Access to Private Fields in User Registration API in strapistrapi · strapi | High7.6 |
| CVE-2023-38507 | Strapi Improper Rate Limiting vulnerabilitystrapi · strapi | High7.3 |
| CVE-2023-37263 | Strapi's field level permissions not being respected in relationship titlestrapi · strapi | Medium6.8 |
| CVE-2023-36472 | Strapi may leak sensitive user information, user reset password, tokens via content-manager viewsstrapi · strapi | Medium5.8 |
| CVE-2023-34235 | Leaking sensitive user information still possible by filtering on private with prefix fieldsstrapi · strapi | High8.6 |
| CVE-2023-34093 | Strapi allows actors to make all attributes on a content-type public without noticing itstrapi · strapi | Medium4.8 |
| CVE-2022-29894 | Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. By exploiting this vulnerability, an arbitrary…Strapi · Strapi | Medium4.8 |
| CVE-2022-30618 | An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if…Strapi · Strapi | High7.5 |
| CVE-2022-30617 | An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel…Strapi · Strapi | High8.8 |
| CVE-2022-0764 | Arbitrary Command Injection in strapi/strapistrapi · strapi/strapi | Medium6.1 |