Skip to content
Getgrav Grav vulnerabilities
-
getgrav grav
Grav Lightbox Gallery 1.1.0 before 1.3.2 File Read via Shortcode Media Actions
CVE-2026-124434
7.1 High
-
getgrav grav
Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback
CVE-2026-117604
8.7 High
-
getgrav grav
Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives
CVE-2026-116019
8.7 High
-
getgrav grav
Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives
CVE-2026-114660
7.0 High
-
getgrav grav-plugin-flex-objects
Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes
CVE-2026-114659
7.1 High
-
getgrav grav-plugin-login
Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite
CVE-2026-114658
8.7 High
-
getgrav grav
Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri
CVE-2026-114657
6.9 Medium
-
getgrav grav
Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service
CVE-2026-112782
8.7 High
-
getgrav grav
Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives
CVE-2026-112781
8.7 High
-
getgrav grav
Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@
CVE-2026-112780
9.3 Critical
-
getgrav grav-plugin-api
Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass
CVE-2026-112779
9.3 Critical
-
getgrav grav
Grav before 2.1.7 Information Disclosure via Nested .git Directories
CVE-2026-109326
8.7 High
-
getgrav grav
Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy
CVE-2026-109325
8.7 High
-
getgrav grav
Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms
CVE-2026-109324
7.1 High
-
getgrav grav-plugin-star-ratings
Grav Star Ratings 2.0.1 through 2.0.3 Missing Server-Side vote_access Authorization
CVE-2026-109323
6.9 Medium
-
getgrav grav-plugin-guestbook
Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views
CVE-2026-109322
5.3 Medium
-
getgrav grav-plugin-login-oauth
Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass
CVE-2026-109321
9.3 Critical
-
getgrav grav-plugin-api
Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass
CVE-2026-109320
5.3 Medium
-
getgrav grav-plugin-guestbook
Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation
CVE-2026-109319
5.3 Medium
-
getgrav grav-plugin-api
Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants
CVE-2026-109317
8.6 High
-
getgrav grav-plugin-data-manager
Grav Data Manager 1.4.0 through 1.4.5 Unauthenticated File Deletion via Admin
CVE-2026-109316
6.9 Medium
-
getgrav grav
Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox
CVE-2026-109315
7.1 High
-
getgrav grav-plugin-login
Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page
CVE-2026-109314
8.5 High
-
getgrav grav-plugin-login
Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie
CVE-2026-109313
8.6 High
-
getgrav grav-plugin-login
Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form
CVE-2026-109312
8.6 High
-
getgrav grav-plugin-datamanager
Grav Data Manager before 1.4.5 Stored XSS via item-detail view
CVE-2026-100673
8.4 High
-
getgrav grav-plugin-comments
grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure
CVE-2026-100672
8.7 High
-
getgrav grav
Grav before 2.0.25 Session Cookie Theft via Twig Sandbox
CVE-2026-100671
Public exploit
8.6 High
-
getgrav grav
Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass
CVE-2026-100670
8.7 High
-
getgrav grav
Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypass
CVE-2026-100669
8.7 High
-
getgrav grav
Grav before 2.0.25 Sandbox Escape via array Filter
CVE-2026-100668
7.1 High
-
getgrav grav
grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass
CVE-2026-100667
6.9 Medium
-
getgrav grav
Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r
CVE-2026-92917
8.7 High
-
getgrav grav
Grav through 2.0.21 Unauthenticated Information Disclosure via Clockwork
CVE-2026-92916
8.7 High
-
getgrav grav
Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of...
CVE-2025-64059
1.8 Low
-
getgrav grav-plugin-api
Grav API Plugin before 1.0.20 Authentication Bypass via Host Header
CVE-2026-86196
8.7 High
-
getgrav grav-plugin-api
grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag
CVE-2026-86195
8.7 High
-
getgrav grav-plugin-form
Grav Form Plugin before 9.1.22 Cross-Page Form Execution
CVE-2026-86194
6.9 Medium
-
getgrav grav-plugin-api
Grav API Plugin Authentication Bypass via Group-Inherited Super
CVE-2026-86193
8.7 High
-
getgrav grav
Grav before 2.0.18 Remote Code Execution via sort filter
CVE-2026-85604
8.7 High
-
getgrav grav
Grav Admin Plugin Path Traversal via Save As Language Code
CVE-2026-85603
7.1 High
-
getgrav grav-plugin-form
Grav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication Bypass
CVE-2026-85602
9.3 Critical
-
getgrav grav
Grav Admin before 2.0.20 Cross-Site Scripting via marked.js
CVE-2026-85601
5.1 Medium
-
getgrav grav-plugin-admin2
Grav Admin before 2.0.21 Stored XSS via username
CVE-2026-85600
5.1 Medium
-
getgrav grav-plugin-shortcode-core
Grav Shortcode Core before 6.2.5 Stored XSS via unescaped parameters
CVE-2026-85599
5.1 Medium
-
getgrav grav
Grav 2.0.0 through 2.0.17 Stored XSS via Modular Pages
CVE-2026-85598
5.1 Medium
-
getgrav grav
Grav before 1.0.18 Authentication Bypass via Scoped API Key
CVE-2026-80204
9.3 Critical
-
getgrav grav
Grav before 1.0.18 Authentication Bypass via Scoped API Key
CVE-2026-80203
9.3 Critical
-
getgrav grav
Grav before 2.0.16 Information Disclosure via Twig Sandbox
CVE-2026-76846
Fix available
8.7 High
-
getgrav grav
Grav before 2.0.16 Information Disclosure via offsetGet
CVE-2026-76839
Fix available
8.7 High
- Show olderLoading…