# cve.now: Strapi

The newest entries naming Strapi as an affected vendor (up to 200), of 29 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-118171](https://cve.now/CVE-2026-118171.md): CVE-2026-118171 (CVSS 6.5)
- [CVE-2026-118172](https://cve.now/CVE-2026-118172.md): CVE-2026-118172 (CVSS 6.1)
- [CVE-2026-118170](https://cve.now/CVE-2026-118170.md): CVE-2026-118170 (CVSS 9.1)
- [CVE-2026-108114](https://cve.now/CVE-2026-108114.md): Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions (CVSS 5.3)
- [CVE-2026-90561](https://cve.now/CVE-2026-90561.md): Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG (CVSS 9.3)
- [CVE-2026-57997](https://cve.now/CVE-2026-57997.md): Strapi users-permissions - JWT Algorithm Confusion via Missing Algorithm Configuration (CVSS 6.3)
- [CVE-2026-27886](https://cve.now/CVE-2026-27886.md): Strapi may leak sensitive data via relational filtering due to lack of query sanitization (CVSS 9.2)
- [CVE-2026-22707](https://cve.now/CVE-2026-22707.md): Strapi Upload Plugin MIME Validation Bypass via Content API (CVSS 5.3)
- [CVE-2026-22706](https://cve.now/CVE-2026-22706.md): Strapi: Password Reset Does Not Revoke Existing Refresh Sessions (CVSS 2.1)
- [CVE-2026-22599](https://cve.now/CVE-2026-22599.md): Strapi Vulnerable to SQL Injection in Content Type Builder (CVSS 9.3)
- [CVE-2025-64526](https://cve.now/CVE-2025-64526.md): Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying (CVSS 6.9)
- [CVE-2025-53092](https://cve.now/CVE-2025-53092.md): Strapi core vulnerable to sensitive data exposure via CORS misconfiguration (CVSS 6.5)
- [CVE-2025-25298](https://cve.now/CVE-2025-25298.md): Missing Maximum Password Length Validation in Strapi Password Hashing (CVSS 6.3)
- [CVE-2024-56143](https://cve.now/CVE-2024-56143.md): Strapi Allows Unauthorized Access to Private Fields via parms.lookup (CVSS 8.2)
- [CVE-2025-3930](https://cve.now/CVE-2025-3930.md): Lack of JWT Expiration after Log Out in Strapi (CVSS 6.3)
- [CVE-2024-52588](https://cve.now/CVE-2024-52588.md): Strapi allows Server-Side Request Forgery in Webhook function (CVSS 4.9)
- [CVE-2024-34065](https://cve.now/CVE-2024-34065.md): @strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass (CVSS 7.1)
- [CVE-2024-31217](https://cve.now/CVE-2024-31217.md): @strapi/plugin-upload has a Denial-of-Service via Improper Exception Handling (CVSS 5.3)
- [CVE-2024-29181](https://cve.now/CVE-2024-29181.md): @strapi/plugin-content-manager leaks data via relations via the Admin Panel (CVSS 2.3)
- [CVE-2023-39345](https://cve.now/CVE-2023-39345.md): Unauthorized Access to Private Fields in User Registration API in strapi (CVSS 7.6)
- [CVE-2023-38507](https://cve.now/CVE-2023-38507.md): Strapi Improper Rate Limiting vulnerability (CVSS 7.3)
- [CVE-2023-37263](https://cve.now/CVE-2023-37263.md): Strapi's field level permissions not being respected in relationship title (CVSS 6.8)
- [CVE-2023-36472](https://cve.now/CVE-2023-36472.md): Strapi may leak sensitive user information, user reset password, tokens via content-manager views (CVSS 5.8)
- [CVE-2023-34235](https://cve.now/CVE-2023-34235.md): Leaking sensitive user information still possible by filtering on private with prefix fields (CVSS 8.6)
- [CVE-2023-34093](https://cve.now/CVE-2023-34093.md): Strapi allows actors to make all attributes on a content-type public without noticing it (CVSS 4.8)
- [CVE-2022-29894](https://cve.now/CVE-2022-29894.md): Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. (no CVSS)
- [CVE-2022-30618](https://cve.now/CVE-2022-30618.md): An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, fo (no CVSS)
- [CVE-2022-30617](https://cve.now/CVE-2022-30617.md): An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, fo (no CVSS)
- [CVE-2022-0764](https://cve.now/CVE-2022-0764.md): Arbitrary Command Injection in strapi/strapi (CVSS 6.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/strapi
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.