strapi strapi

Name: strapi strapi
Brand: strapi

productUS

cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

4critical17high13medium2low

updated 2026-10-27

vulnerabilities (39)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2023-22894US	medium4.9OT critical	4.11% (91st)	KEV	4.8.0	2023-04-19	3.2.1 → 4.8.0
CVE-2019-18818US	critical9.8	97.6% (100th)	Exploit	no fix	2019-11-07	2 versions
CVE-2023-22621US	high7.2	70.6% (99th)	Exploit	4.5.6	2023-04-19	3.0.0 → 4.5.6
CVE-2019-19609US	high7.2	54.1% (99th)	Exploit	no fix	2019-12-05	2 versions
CVE-2022-32114US	high8.8	1.97% (80th)	Exploit	no fix	2022-07-13	= 4.1.12
CVE-2026-27886US	high7.5	1.92% (80th)	Exploit	5.37.0	2026-05-14	4.0.0 → 5.37.0
CVE-2026-22599US	high7.2	1.18% (67th)	Exploit	4.26.1	2026-05-14	2 versions
CVE-2026-22706US	medium6.5	0.34% (27th)	Exploit	5.33.3	2026-05-14	< 5.33.3
CVE-2023-22893US	high7.5	4.12% (91st)	—	4.6.0	2023-04-19	3.0.0 → 4.6.0
CVE-2022-27263US	critical9.8	3.22% (88th)	—	no fix	2022-04-12	= 4.1.5
CVE-2021-46440US	high7.5	2.88% (87th)	—	4.1.5	2022-05-03	2 versions
CVE-2020-27664US	critical9.8OT elevated	2.29% (83rd)	—	3.2.5	2020-10-22	< 3.2.5
CVE-2022-31367US	high8.8	1.72% (77th)	—	4.1.10	2022-09-27	2 versions
CVE-2020-13961US	medium6.5	1.67% (77th)	—	3.0.2	2020-06-19	< 3.0.2
CVE-2022-30617US	high8.8	1.47% (74th)	—	3.6.10	2022-05-19	2 versions
CVE-2021-28128US	high8.1	1.28% (70th)	—	no fix	2021-05-06	≤ 3.6.0
CVE-2020-27665US	high7.5OT elevated	1.21% (68th)	—	3.2.5	2020-10-22	< 3.2.5
CVE-2020-8123US	medium4.9	1.15% (67th)	—	3.0.0	2020-02-04	2 versions
CVE-2023-34235US	high7.5	1.09% (65th)	—	4.10.8	2023-07-25	< 4.10.8
CVE-2023-38507US	critical9.8	0.96% (61st)	—	4.12.1	2023-09-15	< 4.12.1
CVE-2022-30618US	high7.5	0.96% (61st)	—	4.1.10	2022-05-19	2 versions
CVE-2022-29894US	medium4.8	0.77% (55th)	—	no fix	2022-06-13	≤ 3.6.10
CVE-2024-31217US	medium6.5	0.74% (54th)	—	4.22.0	2024-06-12	< 4.22.0
CVE-2022-0764US	medium6.7	0.73% (54th)	—	4.1.0	2022-02-26	< 4.1.0
CVE-2023-34093US	high7.1	0.71% (54th)	—	4.10.8	2023-07-25	< 4.10.8
CVE-2020-27666US	medium5.4	0.71% (54th)	—	3.2.5	2020-10-22	< 3.2.5
CVE-2024-34065US	high8.1OT elevated	0.70% (53rd)	—	4.24.2	2024-06-12	< 4.24.2
CVE-2023-36472US	medium5.7	0.67% (52nd)	—	4.11.7	2023-09-15	< 4.11.7
CVE-2023-37263US	low2.7	0.64% (50th)	—	4.12.1	2023-09-15	< 4.12.1
CVE-2023-39345US	high7.5	0.59% (48th)	—	4.13.1	2023-11-06	4.0.0 → 4.13.1
CVE-2024-52588US	high7.5	0.59% (48th)	—	4.25.2	2025-05-29	< 4.25.2
CVE-2024-37818US	—	0.56% (46th)	—	no fix	2024-06-20	= 4.24.4
CVE-2025-64526US	medium5.3	0.49% (42nd)	—	5.45.0	2026-05-14	< 5.45.0
CVE-2024-56143US	—	0.42% (36th)	—	5.5.2	2025-10-16	5.0.0 → 5.5.2
CVE-2025-25298US	medium5.3	0.40% (34th)	—	5.10.3	2025-10-16	< 5.10.3
CVE-2024-29181US	low3.5	0.39% (32nd)	—	4.19.1	2024-06-12	< 4.19.1
CVE-2025-53092US	—	0.29% (21st)	—	5.20.0	2025-10-16	< 5.20.0
CVE-2026-57997US	medium5.4OT elevated	0.25% (16th)	—	5.7.0	2026-06-29	< 5.7.0
CVE-2026-22707US	medium5.4	0.19% (9th)	—	5.33.3	2026-05-14	< 5.33.3

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-200Exposure of Sensitive Information to an Unauthorized Actor6 CVEs
CWE-434Unrestricted Upload of File with Dangerous Type3 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')3 CVEs
CWE-20Improper Input Validation2 CVEs
CWE-212Improper Removal of Sensitive Information Before Storage or Transfer2 CVEs
CWE-287Improper Authentication2 CVEs
CWE-400Uncontrolled Resource Consumption2 CVEs
CWE-639Authorization Bypass Through User-Controlled Key2 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE39 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan