CVE-2026-112779Critical 9.8Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass0.8%
CVE-2026-109320Medium 5.4Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass0.2%
CVE-2026-109317High 7.2Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants0.4%
CVE-2026-86196High 8.7Grav API Plugin before 1.0.20 Authentication Bypass via Host Header0.4%
CVE-2026-86195High 8.7grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag0.4%
CVE-2026-86193High 8.7Grav API Plugin Authentication Bypass via Group-Inherited Super0.4%
CVE-2026-64852High 8.7Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account0.4%
CVE-2026-63408High 7.5Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter0.5%
CVE-2026-63407High 8.2Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responses0.4%
CVE-2026-62667High 8.1Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL0.4%
CVE-2026-62666High 8.8Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super0.6%
CVE-2026-62668Critical 9.4Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols0.4%
CVE-2026-61607Medium 4.6Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer0.3%
CVE-2026-72833High 8.8Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys0.5%
CVE-2026-72826High 8.8Grav API Plugin before 1.0.13 Scope Bypass via createApiKey0.5%
CVE-2026-72825High 7.6Grav API Plugin before 1.0.13 API-key scope cap bypass via ReportsController0.3%
CVE-2026-61451Critical 9.6Grav API Plugin before 1.0.4 Password Reset Token Poisoning via admin_base_url0.3%
CVE-2026-42843High 8.8grav-plugin-api: Grav API Privilege Escalation to Super Admin0.4%