Strapi vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
40 matching records
- Medium6.3Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance of HS38…Check if you run itEPSS 0.25%Jun 29, 2026
- Critical9.2Strapi is an open source headless content management system.Check if you run itEPSS 1.92%May 13, 2026
- Medium5.3Strapi is an open source headless content management system.Check if you run itEPSS 0.19%May 13, 2026
- Medium6.9Strapi is an open source headless content management system.Check if you run itEPSS 0.49%May 13, 2026
- Low2.1Strapi is an open source headless content management system.Check if you run itEPSS 0.34%May 13, 2026
- Critical9.3Strapi is an open source headless content management system.Check if you run itEPSS 1.18%May 13, 2026
- High8.2Strapi is an open-source headless content management system.Check if you run itEPSS 0.42%Oct 16, 2025
- Medium6.3Strapi is an open source headless CMS.Check if you run itEPSS 0.40%Oct 16, 2025
- High7.5Strapi is an open source headless content management system.Check if you run itEPSS 0.29%Oct 16, 2025
- Medium6.3Strapi uses JSON Web Tokens (JWT) for authentication.Check if you run itEPSS 0.69%Oct 16, 2025
- Medium4.9Strapi is an open-source content management system.Check if you run itEPSS 0.59%May 27, 2025
- High8.6Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image.Check if you run itEPSS 0.56%Jun 20, 2024
- High7.13rd party token leak and authentication bypassCheck if you run itEPSS 0.70%Jun 12, 2024
- Medium5.3Denial-of-Service via Improper Exception HandlingCheck if you run itEPSS 0.74%Jun 12, 2024
- Low2.3Leaking data via relations via the Admin PanelCheck if you run itEPSS 0.39%Jun 12, 2024
- High7.6Unauthorized Access to Private Fields in User Registration APICheck if you run itEPSS 0.59%Nov 3, 2023
- Low2.4Field level permissions not being respected in relationship titleCheck if you run itEPSS 0.64%Sep 13, 2023
- Medium5.8Leaking sensitive user information, user reset password, tokens via content-manager viewsCheck if you run itEPSS 0.67%Sep 13, 2023
- High7.3Improper Rate LimitingCheck if you run itEPSS 0.96%Sep 13, 2023
- High8.6Leaking sensitive user information still possible by filtering on private with prefix fieldsCheck if you run itEPSS 1.09%Jul 25, 2023
- Medium4.8Making all attributes on a content-type public via review workflowsCheck if you run itEPSS 0.71%Jul 25, 2023
- Medium4.9Strapi Cleartext Storage of Sensitive Information VulnerabilityPatch nowKEVEPSS 4.11%Apr 19, 2023
- Critical10.0Strapi Strapi Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')Patch nowKEVEPSS 70.60%Apr 18, 2023
- High8.2Strapi Strapi Improper AuthenticationPatch nowKEVEPSS 4.12%Apr 18, 2023
- High8.8Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses.Check if you run itEPSS 1.72%Sep 27, 2022