strapi

Top products

The 15 most recently published vulnerabilities affecting strapi.

• CVE-2026-57997Strapi users-permissions - JWT Algorithm Confusion via Missing Algorithm Configuration4.8Jun 29, 2026
• CVE-2026-27886Strapi may leak sensitive data via relational filtering due to lack of query sanitization7.5May 14, 2026
• CVE-2026-22707Strapi Upload Plugin MIME Validation Bypass via Content API5.4May 14, 2026
• CVE-2026-22706Strapi: Password Reset Does Not Revoke Existing Refresh Sessions6.5May 14, 2026
• CVE-2026-22599Strapi Vulnerable to SQL Injection in Content Type Builder7.2May 14, 2026
• CVE-2025-64526Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying5.3May 14, 2026
• CVE-2025-53092Strapi core vulnerable to sensitive data exposure via CORS misconfiguration6.5Oct 16, 2025
• CVE-2025-25298Missing Maximum Password Length Validation in Strapi Password Hashing5.3Oct 16, 2025
• CVE-2024-56143Strapi Allows Unauthorized Access to Private Fields via parms.lookup8.2Oct 16, 2025
• CVE-2024-52588Strapi allows Server-Side Request Forgery in Webhook function4.9May 29, 2025
• CVE-2024-37818Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image. This vulnerability allows attackers to scan for open ports or access sensitiv...8.6Jun 20, 2024
• CVE-2024-34065@strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass7.1Jun 12, 2024
• CVE-2024-31217@strapi/plugin-upload has a Denial-of-Service via Improper Exception Handling5.3Jun 12, 2024
• CVE-2024-29181@strapi/plugin-content-manager leaks data via relations via the Admin Panel2.3Jun 12, 2024
• CVE-2023-48218Strapi Protected Populate Plugin leaking fields if the request fields where empty or only fields selected where not populatable5.3Nov 20, 2023