Strapi Strapi vulnerabilities

CVEs per yearBy the year they were published

1. 20223
2. 20236
3. 20243
4. 20255
5. 20268

Newest CVEs

• CVE-2026-108114

  Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions

  strapi · strapi

  Medium5.3
• CVE-2026-90561

  Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG

  strapi · strapi

  Critical9.3
• CVE-2026-57997

  Strapi users-permissions - JWT Algorithm Confusion via Missing Algorithm Configuration

  strapi · strapi

  Medium6.3
• CVE-2026-27886

  Strapi may leak sensitive data via relational filtering due to lack of query sanitization

  strapi · strapi

  Critical9.2
• CVE-2026-22707

  Strapi Upload Plugin MIME Validation Bypass via Content API

  strapi · strapi

  Medium5.3
• CVE-2026-22706

  Strapi: Password Reset Does Not Revoke Existing Refresh Sessions

  strapi · strapi

  Low2.1
• CVE-2026-22599

  Strapi Vulnerable to SQL Injection in Content Type Builder

  strapi · strapi

  Critical9.3
• CVE-2025-64526

  Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying

  strapi · strapi

  Medium6.9
• CVE-2025-53092

  Strapi core vulnerable to sensitive data exposure via CORS misconfiguration

  strapi · strapi

  Medium6.5
• CVE-2025-25298

  Missing Maximum Password Length Validation in Strapi Password Hashing

  strapi · strapi

  Medium6.3