Critical
CVE-2026-27886
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 43
Reset filters
Medium
CVE-2026-22707
Strapi Upload Plugin MIME Validation Bypass via Content API
Low
CVE-2026-22706
Strapi: Password Reset Does Not Revoke Existing Refresh Sessions
Critical
CVE-2026-22599
Strapi Vulnerable to SQL Injection in Content Type Builder
Medium
CVE-2025-64526
Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying
High
CVE-2026-44635
Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`
High
CVE-2025-53092
Strapi core vulnerable to sensitive data exposure via CORS misconfiguration
Medium
CVE-2025-25298
Strapi Password Hashing is Missing Maximum Password Length Validation
High
CVE-2024-56143
Strapi Allows Unauthorized Access to Private Fields via parms.lookup
Medium
CVE-2025-3930
Strapi is vulnerable to Insufficient Session Expiration
Medium
CVE-2024-52588
Strapi allows Server-Side Request Forgery in Webhook function
High
CVE-2024-37818
Strapi Server-Side Request Forgery (SSRF)
High
CVE-2024-34065
@strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass
Medium
CVE-2024-31217
@strapi/plugin-upload has a Denial-of-Service via Improper Exception Handling
Low
CVE-2024-29181
@strapi/plugin-content-manager leaks data via relations via the Admin Panel
Medium
CVE-2023-48218
Bypass of field access control in strapi-plugin-protected-populate
High
CVE-2023-39345
Unauthorized Access to Private Fields in User Registration API
High
CVE-2023-38507
Strapi Improper Rate Limiting vulnerability
Medium
CVE-2023-37263
Strapi's field level permissions not being respected in relationship title
Medium
CVE-2023-36472
Strapi may leak sensitive user information, user reset password, tokens via content-manager views
High
CVE-2023-34235
Leaking sensitive user information still possible by filtering on private with prefix fields
Medium
CVE-2023-34093
Making all attributes on a content-type public without noticing it
Critical
CVE-2023-22621
Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin
High
Exploited in attacks
CVE-2023-22894
Strapi leaking sensitive user information by filtering on private fields
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.