Strapi security vulnerabilities
CMS / eCommerce / ERP. Public CVE monitoring for Strapi. Vendor security advisories are linked on this page.
Built for Operators of this product.
40 public records · 0 security-fix timeline events. 0 published in the last 7 days. 40 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 0
- High 0
- Medium 0
- Low 0
2026-08-090 issues2026-11-06
Known exploited
View all known exploited- Medium4.9Strapi Cleartext Storage of Sensitive Information VulnerabilityPatch nowKEVEPSS 4.11%Apr 19, 2023
- Critical10.0Strapi Strapi Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')Patch nowKEVEPSS 70.60%Apr 18, 2023
- High8.2Strapi Strapi Improper AuthenticationPatch nowKEVEPSS 4.12%Apr 18, 2023
- Critical9.8Strapi Strapi Weak Password Recovery Mechanism for Forgotten PasswordPatch nowKEVEPSS 97.64%Nov 7, 2019
- High7.2Strapi Strapi Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 54.08%Dec 5, 2019
Recently published
Browse catalog- Critical9.2Strapi is an open source headless content management system.Check if you run itEPSS 1.92%May 13, 2026
- Medium5.3Strapi is an open source headless content management system.Check if you run itEPSS 0.19%May 13, 2026
- Medium6.9Strapi is an open source headless content management system.Check if you run itEPSS 0.49%May 13, 2026
- Critical9.3Strapi is an open source headless content management system.Check if you run itEPSS 1.18%May 13, 2026
- High8.2Strapi is an open-source headless content management system.Check if you run itEPSS 0.42%Oct 16, 2025
- Medium6.3Strapi is an open source headless CMS.Check if you run itEPSS 0.40%Oct 16, 2025
- High7.5Strapi is an open source headless content management system.Check if you run itEPSS 0.29%Oct 16, 2025
- Medium6.3Strapi uses JSON Web Tokens (JWT) for authentication.Check if you run itEPSS 0.69%Oct 16, 2025
- Medium4.9Strapi is an open-source content management system.Check if you run itEPSS 0.59%May 27, 2025
- High8.6Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image.Check if you run itEPSS 0.56%Jun 20, 2024