strapi vulnerabilities

CVEs per yearBy the year they were published

1. 20224
2. 20236
3. 20243
4. 20255
5. 202611

Newest CVEs

• CVE-2026-118171

  CVE-2026-118171

  Strapi · Strapi Open Source and Enterprise Headless CMS

  Medium6.5
• CVE-2026-118172

  CVE-2026-118172

  Strapi · Strapi Open Source and Enterprise Headless CMS

  Medium6.1
• CVE-2026-118170

  CVE-2026-118170

  Strapi · Strapi Open Source and Enterprise Headless CMS

  Critical9.1
• CVE-2026-108114

  Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions

  strapi · strapi

  Medium5.3
• CVE-2026-90561

  Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG

  strapi · strapi

  Critical9.3
• CVE-2026-57997

  Strapi users-permissions - JWT Algorithm Confusion via Missing Algorithm Configuration

  strapi · strapi

  Medium6.3
• CVE-2026-27886

  Strapi may leak sensitive data via relational filtering due to lack of query sanitization

  strapi · strapi

  Critical9.2
• CVE-2026-22707

  Strapi Upload Plugin MIME Validation Bypass via Content API

  strapi · strapi

  Medium5.3
• CVE-2026-22706

  Strapi: Password Reset Does Not Revoke Existing Refresh Sessions

  strapi · strapi

  Low2.1
• CVE-2026-22599

  Strapi Vulnerable to SQL Injection in Content Type Builder

  strapi · strapi

  Critical9.3