Getgrav grav-plugin-login

• CVE-2026-114658 High 8.8 Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite 0.3%
• CVE-2026-109314 High 7.3 Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page 0.3%
• CVE-2026-109313 High 8.1 Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie 0.4%
• CVE-2026-109312 High 8.1 Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form 0.4%
• CVE-2026-72699 Medium 5.3 Grav Login Plugin before 3.9.1 Email Enumeration via Registration 0.3%
• CVE-2026-62671 Medium 5.4 CSRF in grav-plugin-login: anonymous attacker rotates a logged-in user's 2FA (TOTP) secret (no nonce on task=login.regenerate2FASecret) 0.2%
• CVE-2026-62669 High 7.4 Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge 0.5%