Crítica
CVE-2026-27886
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 43
Restablecer filtros
Media
CVE-2026-22707
Strapi Upload Plugin MIME Validation Bypass via Content API
Baja
CVE-2026-22706
Strapi: Password Reset Does Not Revoke Existing Refresh Sessions
Crítica
CVE-2026-22599
Strapi Vulnerable to SQL Injection in Content Type Builder
Media
CVE-2025-64526
Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying
Alta
CVE-2026-44635
Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`
Alta
CVE-2025-53092
Strapi core vulnerable to sensitive data exposure via CORS misconfiguration
Media
CVE-2025-25298
Strapi Password Hashing is Missing Maximum Password Length Validation
Alta
CVE-2024-56143
Strapi Allows Unauthorized Access to Private Fields via parms.lookup
Media
CVE-2025-3930
Strapi is vulnerable to Insufficient Session Expiration
Media
CVE-2024-52588
Strapi allows Server-Side Request Forgery in Webhook function
Alta
CVE-2024-37818
Strapi Server-Side Request Forgery (SSRF)
Alta
CVE-2024-34065
@strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass
Media
CVE-2024-31217
@strapi/plugin-upload has a Denial-of-Service via Improper Exception Handling
Baja
CVE-2024-29181
@strapi/plugin-content-manager leaks data via relations via the Admin Panel
Media
CVE-2023-48218
Bypass of field access control in strapi-plugin-protected-populate
Alta
CVE-2023-39345
Unauthorized Access to Private Fields in User Registration API
Alta
CVE-2023-38507
Strapi Improper Rate Limiting vulnerability
Media
CVE-2023-37263
Strapi's field level permissions not being respected in relationship title
Media
CVE-2023-36472
Strapi may leak sensitive user information, user reset password, tokens via content-manager views
Alta
CVE-2023-34235
Leaking sensitive user information still possible by filtering on private with prefix fields
Media
CVE-2023-34093
Making all attributes on a content-type public without noticing it
Crítica
CVE-2023-22621
Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin
Alta
Explotada en ataques
CVE-2023-22894
Strapi leaking sensitive user information by filtering on private fields
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.