Skip to contentGetgrav vulnerabilities
Newest
- getgrav gravGrav CMS before 2.0.16 Origin Validation Bypass via RefererCVE-2026-72702Fix available9.3 Critical
- getgrav gravGrav CMS before 2.0.16 Timing Attack via verifyNonceCVE-2026-72701Fix available6.3 Medium
- getgrav gravGrav before 3.9.1 Timing Attack via Non-Constant-Time Token ComparisonCVE-2026-727008.7 High
- getgrav grav-plugin-loginGrav Login Plugin before 3.9.1 Email Enumeration via RegistrationCVE-2026-726999.3 Critical
- getgrav gravGrav CMS before 2.0.16 Information Disclosure via Twig Sandbox BypassCVE-2026-72698Fix available7.1 High
- getgrav gravGrav CMS before 2.0.16 Path Traversal via media_directoryCVE-2026-72697Fix available7.1 High
- getgrav gravGrav CMS before 2.0.16 Symlink Following via createLockFileCVE-2026-726968.6 High
- getgrav gravGrav before 2.0.16 Path Traversal via MediaUploadTrait deleteFileCVE-2026-72695Fix available7.1 High
- getgrav gravGrav Login Plugin before 1.0.16 Privilege Escalation via UnlockCVE-2026-567109.3 Critical
- getgrav gravGrav before 3.9.2 Host Header Injection via sendInvitationEmailCVE-2026-567098.7 High
- getgrav gravGrav API Plugin before 1.0.16 SSRF via DNS RebindingCVE-2026-567086.9 Medium
- getgrav gravGrav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via ShortcodeCVE-2026-567078.3 High
- getgrav gravGrav before 2.0.20 Cross-Site Scripting via Assets SandboxCVE-2026-86197Fix available5.1 Medium
- getgrav grav-plugin-shortcode-coreGrav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlersCVE-2026-648518.5 High
- getgrav grav-plugin-loginCSRF in grav-plugin-login: anonymous attacker rotates a logged-in user's 2FA (TOTP) secret (no nonce on task=login.regenerate2FASecret)CVE-2026-626715.4 Medium
- getgrav gravGrav: Unauthenticated open redirect via login twofa_cancel _redirectCVE-2026-536545.3 Medium
- getgrav gravGrav before 2.0.14 Privilege Escalation via Group Access FieldCVE-2026-75837Fix available9.3 Critical
- getgrav gravGrav API Plugin before 1.0.14 Missing AuthorizationCVE-2026-758368.7 High
- getgrav gravGrav API Plugin before 1.0.14 Missing AuthorizationCVE-2026-758359.3 Critical
- getgrav gravGrav before 2.0.14 Stored XSS via Invalid UTF-8 ByteCVE-2026-75834Fix available5.1 Medium
- getgrav gravGrav API Plugin Open Redirect via Backslash BypassCVE-2026-758338.6 High
- getgrav gravGrav API Plugin before 1.0.14 Authorization BypassCVE-2026-758329.3 Critical
- getgrav gravGrav before 2.0.15 Stored XSS via audio/video source URLCVE-2026-75831Fix available5.1 Medium
- getgrav gravgrav-plugin-api before 1.0.15 Path Traversal via batchCopyCVE-2026-758307.1 High
- getgrav gravgrav-plugin-api before 1.0.15 Twig SSTI via translate endpointCVE-2026-758298.6 High
- getgrav gravGrav before 2.0.15 Stored XSS via detectXss() Quote BypassCVE-2026-75828Fix available9.3 Critical
- getgrav gravGrav before 2.0.15 Arbitrary File Write via error_logCVE-2026-75827Public exploitFix available9.3 Critical
- getgrav gravGrav Form Plugin before 9.1.19 Stored XSS via Field PropertiesCVE-2026-751075.1 Medium
- getgrav gravGrav plugin-api before 1.0.15 Script Injection via SVGCVE-2026-749085.1 Medium
- getgrav gravGrav before 2.0.15 Path Traversal via plugin-asset-map.phpCVE-2026-74907Fix available8.2 High
- getgrav grav-plugin-apiGrav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API KeysCVE-2026-728338.7 High
- getgrav gravGrav before 2.0.13 Stored XSS via quoted-attribute bypassCVE-2026-72832Fix available5.1 Medium
- getgrav grav, grav-plugin-flex-objects +1 moreGrav through 2.0.11 Authentication Bypass via Flex ObjectsCVE-2026-728318.7 High
- getgrav gravGrav API Plugin before 1.0.13 RCE via ConfigController scope bypassCVE-2026-728308.7 High
- getgrav gravGrav before 1.0.13 API Key Scope Bypass via UsersControllerCVE-2026-728298.7 High
- getgrav gravGrav before 1.0.13 API Key Scope Bypass via InvitationsControllerCVE-2026-728288.6 High
- getgrav gravGrav CMS before 2.0.13 Remote Code Execution via TwigCVE-2026-728278.7 High
- getgrav grav-plugin-apiGrav API Plugin before 1.0.13 Scope Bypass via createApiKeyCVE-2026-728268.7 High
- getgrav grav-plugin-apiGrav API Plugin before 1.0.13 API-key scope cap bypass via ReportsControllerCVE-2026-728257.2 High
- getgrav gravGrav before 1.0.13 API Key Scope Bypass via PagesControllerCVE-2026-728248.7 High
- getgrav gravGrav before 1.0.13 API-key scope cap bypass via DemoControllerCVE-2026-728235.3 Medium
- getgrav gravGrav before 1.0.13 Authentication Bypass via disable2faCVE-2026-728228.7 High
- getgrav gravGrav Form Plugin before 9.1.15 Stored XSS via Radio ToggleCVE-2026-728215.1 Medium
- getgrav gravGrav 2.0.11 Path Traversal via Backup Profile ConfigurationCVE-2026-728206.9 Medium
- getgrav gravGrav CMS before 2.0.13 Remote Code Execution via ZIP UploadCVE-2026-72819Fix available8.7 High
- getgrav gravGrav CMS before 2.0.11 Path Traversal via watermarkCVE-2026-69089Fix available8.7 High
- getgrav gravGrav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via BlueprintCVE-2026-69088Fix available8.6 High
- getgrav grav-plugin-formGrav Form Plugin before 9.1.13 Open Redirect via form.value() TwigCVE-2026-690877.1 High
- getgrav gravGrav Login Plugin before 3.8.13 Insufficient Session ExpirationCVE-2026-664006.3 Medium
- getgrav gravGrav API Plugin 1.0.9 Privilege Escalation via Invitations groupsCVE-2026-658978.7 High
- Show moreLoading…