Getgrav Grav

• CVE-2026-58655 High 8.8 Grav Flex Objects - Server-Side Template Injection via Dynamic Titles 1.4%
• CVE-2026-61454 Medium 5.3 Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__ 0.3%
• CVE-2026-59193 Medium 6.9 Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip() 0.6%
• CVE-2026-59190 High 8.7 Grav Admin Plugin — IDOR Privilege Escalation via saveUser() 0.3%
• CVE-2026-58493 Medium 5.1 grav-plugin-database: DSN Parameter Injection via Unsanitized Configuration Values in Connection String Construction 0.4%
• CVE-2026-58492 Critical 9.2 grav-plugin-database: SQL Injection in PDO::tableExists() due to Unsanitized Table Name Interpolation 0.5%
• CVE-2026-55890 Medium 4.8 Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() 0.5%
• CVE-2026-55885 Medium 6.8 Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets 0.2%
• CVE-2026-53653 High 8.7 Grav: Unauthenticated denial of service via unbounded image derivative dimensions 0.5%
• CVE-2026-61456 Medium 4.6 Grav before 1.0.3 Stored XSS via SVG Upload API 0.2%
• CVE-2026-61455 Medium 6.5 Grav before 2.0.1 Decompression Bomb via ZipArchiver 0.3%
• CVE-2026-61450 Medium 6.5 Grav before 2.0.2 Config Exfiltration via offsetGet Filter 5.4%
• CVE-2026-58656 High 7.5 Grav API Plugin - Cross-Origin Admin Account Takeover via CORS Wildcard and JWT Query Parameter 0.4%
• CVE-2026-42844 High 8.7 Grav: Low-privileged API users can create super-admin accounts via blueprint-upload 0.3%
• CVE-2026-44738 High 7.7 Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray() 0.3%
• CVE-2026-42842 Medium 5.4 grav-plugin-form: XSS via Taxonomy Field Values in Admin Panel 0.2%
• CVE-2026-42613 Critical 9.4 Grav: Privilege Escalation via Missing Server-Side Validation of groups/access 1.1%
• CVE-2026-42612 High 8.5 Grav: Publisher-Level Stored XSS via Unquoted Event Attributes 0.2%
• CVE-2026-42611 High 8.9 Grav: Stored XSS via Tag Injection 0.3%
• CVE-2026-42610 Medium 6.5 Grav: Sensitive Information Disclosure via Accounts Service Bypass 0.3%
• CVE-2026-42609 High 8.1 Grav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic 0.5%
• CVE-2026-42608 High 8.8 Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component. 0.6%
• CVE-2026-42607 Critical 9.1 Grav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature 4.4%
• CVE-2026-42841 Medium 6.9 Grav: Stored XSS via Markdown media attribute() action in Grav CMS 0.4%
• CVE-2025-66312 Medium 6.2 Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName]` 0.2%
• CVE-2025-66311 Medium 6.2 Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters 0.2%
• CVE-2025-66310 Medium 6.2 Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tab 0.2%
• CVE-2025-66309 Medium 6.2 Grav vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab 0.2%
• CVE-2025-66308 Medium 6.8 Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/config/site` parameter `data[taxonomies]` 0.2%
• CVE-2025-66307 Medium 6.5 Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure 0.3%
• CVE-2025-66306 Medium 4.3 Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel 0.3%
• CVE-2025-66305 Medium 6.9 Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter 0.4%
• CVE-2025-66304 Medium 6.2 Grav Exposes Password Hashes Leading to privilege escalation 0.4%
• CVE-2025-66303 Medium 4.9 Grav is vulnerable to a DOS on the admin panel 0.4%
• CVE-2025-66302 Medium 6.8 Grav vulnerable to Path Traversal allowing server files backup 0.5%
• CVE-2025-66301 High 8.6 Grav ihas Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions 1.4%
• CVE-2025-66300 High 8.5 Grav is vulnerable to Arbitrary File Read 0.5%
• CVE-2025-66299 High 8.8 Security Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMS 0.7%
• CVE-2025-66298 High 7.7 Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms 0.4%
• CVE-2025-66297 High 7.4 Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection 0.8%
• CVE-2025-66296 High 8.8 Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover 0.3%
• CVE-2025-66294 High 8.7 Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass 3.0%
• CVE-2025-66295 High 8.8 Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption 0.6%
• CVE-2024-34082 High 8.5 Grav Arbitrary File Read to Account Takeover 3.0%
• CVE-2024-28119 High 8.8 Grav vulnerable to Server Side Template Injection (SSTI) via Twig escape handler 1.6%
• CVE-2024-28118 High 8.8 Grav vulnerable to Server Side Template Injection (SSTI) 1.2%
• CVE-2024-28117 High 8.8 Grav vulnerable to Server Side Template Injection (SSTI) 1.4%
• CVE-2024-28116 High 8.8 Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass 5.8%
• CVE-2024-27921 High 8.8 Grav File Upload Path Traversal vulnerability 60.6%
• CVE-2024-27923 High 8.8 Remote Code Execution by uploading a phar file using frontmatter 1.4%