Getgrav Grav

• CVE-2026-117604 High 7.5 Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback 0.3%
• CVE-2026-116019 High 8.8 Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives 0.3%
• CVE-2026-114660 Medium 6.3 Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives 0.2%
• CVE-2026-114657 Medium 5.7 Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri 0.2%
• CVE-2026-112782 High 7.5 Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service 0.8%
• CVE-2026-112781 Medium 6.5 Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives 0.6%
• CVE-2026-112780 High 8.8 Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@ 0.7%
• CVE-2026-109326 High 7.5 Grav before 2.1.7 Information Disclosure via Nested .git Directories 0.3%
• CVE-2026-109325 High 7.5 Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy 0.4%
• CVE-2026-109324 Medium 6.5 Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms 0.3%
• CVE-2026-109315 Medium 6.5 Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox 0.3%
• CVE-2026-100671 High 8.0 Grav before 2.0.25 Session Cookie Theft via Twig Sandbox 0.4%
• CVE-2026-100670 High 8.8 Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass 0.4%
• CVE-2026-100669 High 7.5 Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypass 0.4%
• CVE-2026-100668 Medium 6.5 Grav before 2.0.25 Sandbox Escape via array Filter 0.3%
• CVE-2026-100667 Medium 5.3 grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass 0.3%
• CVE-2026-92917 High 7.5 Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r 0.5%
• CVE-2026-92916 High 7.5 Grav through 2.0.21 Unauthenticated Information Disclosure via Clockwork 0.5%
• CVE-2025-64059 Low 1.8 Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and up 0.1%
• CVE-2026-86197 Medium 5.1 Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox 0.4%
• CVE-2026-85604 High 8.8 Grav before 2.0.18 Remote Code Execution via sort filter 0.9%
• CVE-2026-85603 Medium 6.5 Grav Admin Plugin Path Traversal via Save As Language Code 0.6%
• CVE-2026-85601 Medium 5.4 Grav Admin before 2.0.20 Cross-Site Scripting via marked.js 0.3%
• CVE-2026-85598 Medium 6.4 Grav 2.0.0 through 2.0.17 Stored XSS via Modular Pages 0.3%
• CVE-2026-80204 Medium 5.4 Grav before 1.0.18 Authentication Bypass via Scoped API Key 0.2%
• CVE-2026-80203 Critical 9.8 Grav before 1.0.18 Authentication Bypass via Scoped API Key 0.5%
• CVE-2026-76846 High 7.5 Grav before 2.0.16 Information Disclosure via Twig Sandbox 0.3%
• CVE-2026-76839 Medium 6.5 Grav before 2.0.16 Information Disclosure via offsetGet 0.3%
• CVE-2026-75574 High 8.8 Grav before 4.2.2 Remote Code Execution via Email Twig 0.7%
• CVE-2026-72702 Medium 5.4 Grav CMS before 2.0.16 Origin Validation Bypass via Referer 0.1%
• CVE-2026-72701 Low 3.7 Grav CMS before 2.0.16 Timing Attack via verifyNonce 0.2%
• CVE-2026-72700 High 7.5 Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparison 0.4%
• CVE-2026-72698 Medium 6.5 Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass 0.4%
• CVE-2026-72697 Medium 6.5 Grav CMS before 2.0.16 Path Traversal via media_directory 0.4%
• CVE-2026-72696 High 8.4 Grav CMS before 2.0.16 Symlink Following via createLockFile 0.2%
• CVE-2026-72695 High 8.1 Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile 0.6%
• CVE-2026-56710 Critical 9.8 Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock 0.5%
• CVE-2026-56709 High 7.5 Grav before 3.9.2 Host Header Injection via sendInvitationEmail 0.4%
• CVE-2026-56708 Medium 5.3 Grav API Plugin before 1.0.16 SSRF via DNS Rebinding 0.3%
• CVE-2026-56707 High 7.7 Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcode 0.4%
• CVE-2026-64850 High 8.7 Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData() 0.5%
• CVE-2026-62673 High 8.2 Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems 0.5%
• CVE-2026-62672 Medium 6.0 Grav: Authenticated ReDoS via regex_replace in Twig Sandbox 0.4%
• CVE-2026-62669 High 7.4 Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge 0.5%
• CVE-2026-62668 Critical 9.4 Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols 0.4%
• CVE-2026-61842 Medium 6.5 Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass) 0.4%
• CVE-2026-61690 Medium 6.5 Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits 0.5%
• CVE-2026-53654 Medium 5.3 Grav: Unauthenticated open redirect via login twofa_cancel _redirect 0.5%
• CVE-2026-75837 Critical 9.1 Grav before 2.0.14 Privilege Escalation via Group Access Field 0.5%
• CVE-2026-75836 High 8.8 Grav API Plugin before 1.0.14 Missing Authorization 0.5%