Corregido en
CVE que afectan a 4.26
| CVE | Título | CVSS | Explotada | EPSS | Publicación |
|---|---|---|---|---|---|
| CVE-2026-90561 | Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG | 9.3 | — | 2026-09-13 | |
| CVE-2026-22599 | Strapi Vulnerable to SQL Injection in Content Type Builder | 9.3 | — | 2026-05-14 | |
| CVE-2026-27886 | Strapi may leak sensitive data via relational filtering due to lack of query sanitization | 9.2 | — | 2026-05-14 | |
| CVE-2025-64526 | Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying | 6.9 | — | 2026-05-14 | |
| CVE-2025-53092 | Strapi core vulnerable to sensitive data exposure via CORS misconfiguration | 6.5 | — | 2025-10-16 | |
| CVE-2025-3930 | Lack of JWT Expiration after Log Out in Strapi | 6.3 | — | 2025-10-16 | |
| CVE-2025-25298 | Missing Maximum Password Length Validation in Strapi Password Hashing | 6.3 | — | 2025-10-16 | |
| CVE-2026-57997 | Strapi users-permissions - JWT Algorithm Confusion via Missing Algorithm Configuration | 6.3 | — | 2026-06-29 | |
| CVE-2026-22707 | Strapi Upload Plugin MIME Validation Bypass via Content API | 5.3 | — | 2026-05-14 | |
| CVE-2026-22706 | Strapi: Password Reset Does Not Revoke Existing Refresh Sessions | 2.1 | — | 2026-05-14 |
Controla estas versiones en tus propios servidores
InfraGuard recopila las versiones de software instaladas en cada servidor y señala las que tienen vulnerabilidades conocidas. Autoalojado: nada sale de tu red.
Datos: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (consulta EPSS en https://www.first.org/epss), endoflife.date. Lista de software: awesome-selfhosted (CC BY-SA 3.0).