Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-118170

CVE-2026-118170

The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Strapi
Products
Strapi Open Source And Enterprise Headless Cms
CVE-2026-118172

CVE-2026-118172

The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redirects without performing post-redirect IP resolution or RFC1918/link-local boundary checks. Non-2xx responses from target endpoints are captured and reflected directly back to the caller.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Strapi
Products
Strapi Open Source And Enterprise Headless Cms
CVE-2026-118171

CVE-2026-118171

The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Strapi
Products
Strapi Open Source And Enterprise Headless Cms