Vendors / Strapi

Strapi vulnerabilities being exploited

1 Strapi flaw was confirmed exploited in the wild in the past 365 days, across 1 product: Strapi. If you run any of them, patch these first.

Added	Exploited vulnerability	Fix by
2026-10-08	CVE-2023-22894 Strapi Strapi Cleartext Storage of Sensitive Information Vulnerability Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.	2026-10-11

Watch my Strapi software Scan a website All vendors

Source: CISA Known Exploited Vulnerabilities catalog 2026.10.29 (live). A listing means some versions are affected: check yours in the advisory. Guidance only.