Getgrav
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| Grav | 157 | – | Oct 27, 2026 |
| grav-plugin-api | 18 | – | Oct 19, 2026 |
| getgrav/grav | 8 | – | Jun 29, 2022 |
| grav-plugin-login | 7 | – | Oct 22, 2026 |
| grav-plugin-form | 5 | – | Sep 5, 2026 |
| grav-plugin-admin | 3 | – | May 11, 2026 |
| grav-plugin-shortcode-core | 2 | – | Sep 4, 2026 |
| grav-plugin-guestbook | 2 | – | Oct 12, 2026 |
| grav-plugin-flex-objects | 2 | – | Oct 22, 2026 |
| getgrav/grav-plugin-admin | 2 | – | Nov 19, 2021 |
| GravCMS | 1 | – | Jan 15, 2026 |
| Grav CMS Admin Plugin | 1 | – | Jan 26, 2026 |
| grav-plugin-admin2 | 1 | – | Sep 4, 2026 |
| grav-plugin-comments | 1 | – | Sep 26, 2026 |
| grav-plugin-data-manager | 1 | – | Oct 12, 2026 |
| grav-plugin-datamanager | 1 | – | Sep 26, 2026 |
| grav-plugin-login-oauth | 1 | – | Oct 12, 2026 |
| grav-plugin-star-ratings | 1 | – | Oct 12, 2026 |
Exploited and recent CVEs
- CVE-2026-117604 Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback 0.3%
- CVE-2026-116019 Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives 0.3%
- CVE-2026-114660 Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives 0.2%
- CVE-2026-114659 Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes 0.6%
- CVE-2026-114658 Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite 0.3%
- CVE-2026-114657 Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri 0.2%
- CVE-2026-112782 Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service 0.8%
- CVE-2026-112781 Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives 0.6%
- CVE-2026-112780 Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@ 0.7%
- CVE-2026-112779 Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass 0.8%
- CVE-2026-109326 Grav before 2.1.7 Information Disclosure via Nested .git Directories 0.3%
- CVE-2026-109325 Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy 0.4%
- CVE-2026-109324 Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms 0.3%
- CVE-2026-109323 Grav Star Ratings 2.0.1 through 2.0.3 Missing Server-Side vote_access Authorization 0.3%
- CVE-2026-109322 Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views 0.2%
- CVE-2026-109321 Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass 0.4%
- CVE-2026-109320 Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass 0.2%
- CVE-2026-109319 Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation 0.2%
- CVE-2026-109317 Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants 0.4%
- CVE-2026-109316 Grav Data Manager 1.4.0 through 1.4.5 Unauthenticated File Deletion via Admin 0.3%
- CVE-2026-109315 Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox 0.3%
- CVE-2026-109314 Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page 0.3%
- CVE-2026-109313 Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie 0.4%
- CVE-2026-109312 Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form 0.4%
- CVE-2026-100673 Grav Data Manager before 1.4.5 Stored XSS via item-detail view 0.3%
- CVE-2026-100672 grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure 0.6%
- CVE-2026-100671 Grav before 2.0.25 Session Cookie Theft via Twig Sandbox 0.4%
- CVE-2026-100670 Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass 0.4%
- CVE-2026-100669 Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypass 0.4%
- CVE-2026-100668 Grav before 2.0.25 Sandbox Escape via array Filter 0.3%