Skip to contentGetgrav vulnerabilities
Newest
- getgrav gravGrav API Plugin before 1.0.10 Path Traversal via moveCVE-2026-658967.1 High
- getgrav gravGrav API Plugin before 1.0.10 Broken Access ControlCVE-2026-658958.2 High
- getgrav gravGrav before 2.0.9 Remote Code Execution via FlexDirectoryCVE-2026-65608Fix available8.7 High
- getgrav gravGrav Login Plugin 3.8.11 Privilege Escalation via Profile UpdateCVE-2026-656038.7 High
- getgrav gravGrav: Remote code execution via unrestricted callable in Blueprint::dynamicData()CVE-2026-64850Fix available8.7 High
- getgrav gravGrav before 2.0.7 Remote Code Execution via Blueprint dynamicDataCVE-2026-65008Public exploit9.3 Critical
- getgrav grav-plugin-apiGrav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any accountCVE-2026-648528.7 High
- getgrav gravGrav before 1.0.8 Missing Authorization on API Key GenerationCVE-2026-650078.7 High
- getgrav gravGrav Stored Cross-Site Scripting via Shortcode Attribute HandlersCVE-2026-646285.1 Medium
- getgrav getgrav/grav, trilby media grav-plugin-scheduler-webhook +1 moreGrav CMS Scheduler Webhook Authentication Bypass via Null Short-CircuitCVE-2026-114306.9 Medium
- getgrav grav-plugin-apiGrav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API ResponsesCVE-2026-634078.2 High
- getgrav gravGrav < 1.0.0-rc.16 CORS Misconfiguration via API PluginCVE-2026-623877.1 High
- getgrav grav-plugin-apiGrav API Plugin: JWT Access Token Accepted via `?token=` URL Query ParameterCVE-2026-634087.5 High
- getgrav gravGrav < 1.0.0-rc.16 Authentication Bypass via token URL ParameterCVE-2026-623868.2 High
- getgrav gravGrav: Authenticated ReDoS via regex_replace in Twig SandboxCVE-2026-62672Fix available6.0 Medium
- getgrav gravGrav < 2.0.4 ReDoS via regex_replace in SandboxCVE-2026-622376.0 Medium
- getgrav gravgrav-plugin-login < 3.8.11 CSRF via regenerate2FASecretCVE-2026-622362.3 Low
- getgrav grav-plugin-flex-objectsFail-open authorization in grav-plugin-flex-objects admin-next API: api.access user gets full CRUD on permission-less directories (requireFlexPermission missing else-deny)CVE-2026-626706.3 Medium
- getgrav gravGrav Flex-Objects < 1.4.3 Authorization Bypass via APICVE-2026-622352.3 Low
- getgrav grav, grav-plugin-api +1 moreGrav API Plugin: Webhook SSRF via Unrestricted cURL ProtocolsCVE-2026-626689.4 Critical
- getgrav grav-plugin-apiGrav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of superCVE-2026-626668.8 High
- getgrav gravGrav < 2.0.4 SSRF via Unrestricted cURL ProtocolsCVE-2026-622348.4 High
- getgrav gravgrav-plugin-api < 1.0.6 Privilege Escalation via createApiKeyCVE-2026-622338.7 High
- getgrav grav, grav-plugin-login +1 moreGrav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending ChallengeCVE-2026-62669Fix available7.4 High
- getgrav gravGrav < 2.0.4 2FA Bypass via Secret RegenerationCVE-2026-622329.1 Critical
- getgrav grav-plugin-apiGrav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACLCVE-2026-626678.1 High
- getgrav gravGrav < 1.0.6 API Key Scope Bypass via ApiKeyAuthenticatorCVE-2026-622318.6 High
- getgrav gravGrav: .htaccess file extension rules bypass via case variation on case-insensitive filesystemsCVE-2026-62673Fix available8.2 High
- getgrav gravGrav < 2.0.4 File Access Bypass via Case VariationCVE-2026-622308.7 High
- getgrav gravGrav before 9.1.8 Arbitrary File Write via Twig-Processed FilenameCVE-2026-618737.2 High
- getgrav gravGrav before 1.0.3 Remote Code Execution via File Upload Extension BypassCVE-2026-614575.3 Medium
- getgrav gravGrav before 2.0.1 XSS via Twig String ConcatenationCVE-2026-61453Fix available5.1 Medium
- getgrav gravGrav before 2.0.4 Improper Session Invalidation JWT Access TokensCVE-2026-614526.9 Medium
- getgrav grav-plugin-apiGrav API Plugin before 1.0.4 Password Reset Token Poisoning via admin_base_urlCVE-2026-614519.4 Critical
- getgrav gravGrav before 2.0.2 Decompression Bomb via Forged ZIP SizeCVE-2026-61449Fix available7.1 High
- getgrav gravGrav Flex Objects - Server-Side Template Injection via Dynamic TitlesCVE-2026-586558.7 High
- getgrav gravGrav before 2.0.4 Information Disclosure via __GRAV_CONFIG__CVE-2026-614548.7 High
- getgrav gravGrav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()CVE-2026-59193Fix available6.9 Medium
- getgrav gravGrav Admin Plugin — IDOR Privilege Escalation via saveUser()CVE-2026-591908.7 High
- getgrav gravgrav-plugin-database: DSN Parameter Injection via Unsanitized Configuration Values in Connection String ConstructionCVE-2026-584935.1 Medium
- getgrav gravgrav-plugin-database: SQL Injection in PDO::tableExists() due to Unsanitized Table Name InterpolationCVE-2026-584929.2 Critical
- getgrav gravGrav: Unauthenticated denial of service via unbounded image derivative dimensionsCVE-2026-53653Fix available8.7 High
- getgrav grav-plugin-apiGrav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses SanitizerCVE-2026-616074.6 Medium
- getgrav gravGrav before 1.0.3 Stored XSS via SVG Upload APICVE-2026-614565.1 Medium
- getgrav gravGrav: Decompression Bomb via ZipArchiver - Missing Extraction LimitsCVE-2026-61690Fix available6.5 Medium
- getgrav gravGrav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)CVE-2026-61842Fix available6.5 Medium
- getgrav gravGrav before 2.0.1 Decompression Bomb via ZipArchiverCVE-2026-614557.1 High
- getgrav gravGrav before 2.0.2 Config Exfiltration via offsetGet FilterCVE-2026-614507.1 High
- getgrav gravGrav - Stored CSS Injection via Markdown Image resize() ActionCVE-2026-58657Fix available4.8 Medium
- getgrav gravGrav API Plugin - Cross-Origin Admin Account Takeover via CORS Wildcard and JWT Query ParameterCVE-2026-586568.7 High
- Show moreLoading…