Priority LOW 28
Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance of HS384 and HS512 tokens alongside HS256.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00249 · Published 2026-06-29 · Fixed in 5.7.0 CWE-327
Priority MEDIUM 49
Strapi is an open source headless content management system.
CVSS 4.0CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.01916 · Published 2026-05-14 · Fixed in 5.37.0 CWE-200
Priority LOW 29
Strapi is an open source headless content management system.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00195 · Published 2026-05-14 · Fixed in 5.33.3 CWE-434
Priority LOW 11
Strapi is an open source headless content management system.
CVSS 4.0LOW 2.1· Network · High privileges · No interaction · EPSS 0.00341 · Published 2026-05-14 · Fixed in 5.33.3 CWE-613
Priority MEDIUM 44
Strapi is an open source headless content management system.
CVSS 4.0CRITICAL 9.3· Network · High privileges · No interaction · EPSS 0.01178 · Published 2026-05-14 · Fixed in 5.33.2, 4.26.1 CWE-89
Priority LOW 39
Strapi is an open source headless content management system.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00492 · Published 2026-05-14 · Fixed in 5.45.0 CWE-307
Priority LOW 29
Strapi is an open source headless content management system.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00289 · Published 2025-10-16 · Fixed in 5.20.0 CWE-200
Priority MEDIUM 61
Strapi is an open source headless CMS.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.004 · Published 2025-10-16 · Fixed in 5.10.3 CWE-261
Priority HIGH 75
Strapi is an open-source headless content management system.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.00418 · Published 2025-10-16 · Fixed in 5.5.2 CWE-639
Priority HIGH 66
Strapi is an open-source content management system.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00586 · Published 2025-05-29 · Fixed in 4.25.2 CWE-918
Priority HIGH 76
Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.00556 · Published 2024-06-20 · No fix listed CWE-918
Priority LOW 36
Strapi is an open-source content management system.
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.00704 · Published 2024-06-12 · Fixed in 4.24.2 CWE-294
Priority MEDIUM 62
Strapi is an open-source content management system.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00736 · Published 2024-06-12 · Fixed in 4.22.0 CWE-248
Priority MEDIUM 50
Strapi is an open-source content management system.
CVSS 3.1LOW 3.5· Network · Low privileges · User interaction · EPSS 0.00385 · Published 2024-06-12 · Fixed in 4.19.1 CWE-639
Priority HIGH 66
strapi is an open-source headless CMS.
CVSS 3.1HIGH 7.6· Adjacent network · No auth · No interaction · EPSS 0.00593 · Published 2023-11-06 · Fixed in 4.13.1 CWE-287
Priority HIGH 81
Strapi is the an open-source headless content management system.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00963 · Published 2023-09-15 · Fixed in 4.12.1 CWE-770
Priority MEDIUM 63
Strapi is the an open-source headless content management system.
CVSS 3.1MEDIUM 6.8· Network · Low privileges · User interaction · EPSS 0.00635 · Published 2023-09-15 · Fixed in 4.12.1 CWE-200
Priority MEDIUM 59
Strapi is an open-source headless content management system.
CVSS 3.1MEDIUM 5.8· Network · Low privileges · User interaction · EPSS 0.00672 · Published 2023-09-15 · Fixed in 4.11.7 CWE-200
Priority HIGH 76
Strapi is an open-source headless content management system.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.01095 · Published 2023-07-25 · Fixed in 4.10.8 CWE-200
Priority MEDIUM 64
Strapi is an open-source headless content management system.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00715 · Published 2023-07-25 · Fixed in 4.10.8 CWE-200
Priority CRITICAL 91KEV
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.04114 · Published 2023-04-19 · Fixed in 4.8.0 CWE-312
Priority MEDIUM 49
Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.04124 · Published 2023-04-19 · Fixed in 4.6.0 CWE-287
Priority HIGH 80
Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.706 · Published 2023-04-19 · Fixed in 4.5.6 CWE-74
Priority MEDIUM 43
Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0172 · Published 2022-09-27 · Fixed in 3.6.10, 4.1.10 CWE-89
Priority MEDIUM 42
An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01974 · Published 2022-07-13 · No fix listed CWE-434
Load more
THREATIST.IORead the docs