S
Vendor security profile1 actively exploited CVEs
strapi
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs5
Critical1
CISA KEV1
Public exploit2
Patch rate%40
Avg. CVSS7.2
12-month vulnerability rate
0
0
0
0
0
0
0
1
0
0
1
1
CVE KEV
CVE severity distribution
5toplam CVE
Critical1 (20%)
High2 (40%)
Medium2 (40%)
Patch and exploitation view
%40
Verified patch
%20
CISA KEV
%40
Public exploit
2Patch available
0Partial
1Workaround
0Vendor: no patch
2Unknown
Latest vulnerabilities
5.3
CVE-2026-108114
Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions
S
Patch status unknownEPSS %0
9.3
CVE-2026-90561
Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG
S
Patch verifiedEPSS %0
5.4
CVE-2026-57997
Broken cryptographic algorithm in Strapi
S
Patch verifiedEPSS %0
7.2
CVE-2023-22894 Actively exploited
Vulnerability in N/a
N
WorkaroundEPSS %4
8.8
CVE-2022-32114
Unrestricted file upload in Strapi
S
Patch status unknownEPSS %2