npm strapi

Name: npm strapi
Brand: npm

productUS

pkg:npm/strapi

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

3critical6high3medium0low

updated 2026-10-28

vulnerabilities (12)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2019-18818US	critical9.8	97.6% (100th)	Exploit	3.0.0-beta.17.5	2019-11-07	< 3.0.0-beta.17.5
CVE-2019-19609US	high7.2	54.1% (99th)	Exploit	3.0.0-beta.17.8	2019-12-05	< 3.0.0-beta.17.8
CVE-2022-27263US	critical9.8	3.22% (88th)	—	no fix	2022-04-12	≤ 4.1.5
CVE-2021-46440US	high7.5	2.88% (87th)	—	3.6.9	2022-05-03	< 3.6.9
CVE-2020-27664US	critical9.8OT elevated	2.29% (83rd)	—	3.2.5	2020-10-22	< 3.2.5
CVE-2022-31367US	high8.8	1.72% (77th)	—	3.6.10	2022-09-27	< 3.6.10
CVE-2020-13961US	medium6.5	1.67% (77th)	—	3.0.2	2020-06-19	< 3.0.2
CVE-2022-30617US	high8.8	1.47% (74th)	—	3.6.9	2022-05-19	3.0.0 → 3.6.9
CVE-2021-28128US	high8.1	1.28% (70th)	—	no fix	2021-05-06	≤ 3.6.0
CVE-2022-30618US	high7.5	0.96% (61st)	—	3.6.9	2022-05-19	3.0.0 → 3.6.9
CVE-2022-29894US	medium4.8	0.77% (55th)	—	no fix	2022-06-13	≤ 3.6.10
CVE-2022-0764US	medium6.7	0.73% (54th)	—	4.1.0	2022-02-26	< 4.1.0

The flaw types (CWEs) most of these CVEs share.

CWE-20Improper Input Validation2 CVEs
CWE-212Improper Removal of Sensitive Information Before Storage or Transfer2 CVEs
CWE-640Weak Password Recovery Mechanism for Forgotten Password2 CVEs
CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')2 CVEs
CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')2 CVEs
CWE-434Unrestricted Upload of File with Dangerous Type1 CVEs
CWE-522Insufficiently Protected Credentials1 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.