Getgrav Grav

• CVE-2026-75835 Medium 4.3 Grav API Plugin before 1.0.14 Missing Authorization 0.3%
• CVE-2026-75834 Medium 5.4 Grav before 2.0.14 Stored XSS via Invalid UTF-8 Byte 0.3%
• CVE-2026-75833 Medium 4.2 Grav API Plugin Open Redirect via Backslash Bypass 0.2%
• CVE-2026-75832 Medium 4.3 Grav API Plugin before 1.0.14 Authorization Bypass 0.3%
• CVE-2026-75831 High 7.6 Grav before 2.0.15 Stored XSS via audio/video source URL 0.4%
• CVE-2026-75830 High 7.1 grav-plugin-api before 1.0.15 Path Traversal via batchCopy 0.4%
• CVE-2026-75829 High 8.1 grav-plugin-api before 1.0.15 Twig SSTI via translate endpoint 0.4%
• CVE-2026-75828 High 8.7 Grav before 2.0.15 Stored XSS via detectXss() Quote Bypass 0.4%
• CVE-2026-75827 High 8.8 Grav before 2.0.15 Arbitrary File Write via error_log 0.9%
• CVE-2026-75107 Medium 5.4 Grav Form Plugin before 9.1.19 Stored XSS via Field Properties 0.2%
• CVE-2026-74908 Medium 4.6 Grav plugin-api before 1.0.15 Script Injection via SVG 0.3%
• CVE-2026-74907 Medium 5.9 Grav before 2.0.15 Path Traversal via plugin-asset-map.php 0.4%
• CVE-2026-72832 Medium 5.4 Grav before 2.0.13 Stored XSS via quoted-attribute bypass 0.3%
• CVE-2026-72831 High 8.8 Grav through 2.0.11 Authentication Bypass via Flex Objects 0.9%
• CVE-2026-72830 High 8.8 Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass 0.7%
• CVE-2026-72829 High 8.8 Grav before 1.0.13 API Key Scope Bypass via UsersController 0.5%
• CVE-2026-72828 High 7.2 Grav before 1.0.13 API Key Scope Bypass via InvitationsController 0.5%
• CVE-2026-72827 High 8.8 Grav CMS before 2.0.13 Remote Code Execution via Twig 0.9%
• CVE-2026-72824 High 8.8 Grav before 1.0.13 API Key Scope Bypass via PagesController 0.7%
• CVE-2026-72823 Medium 5.4 Grav before 1.0.13 API-key scope cap bypass via DemoController 0.3%
• CVE-2026-72822 High 8.8 Grav before 1.0.13 Authentication Bypass via disable2fa 0.6%
• CVE-2026-72821 Medium 5.4 Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle 0.2%
• CVE-2026-72820 Medium 4.9 Grav 2.0.11 Path Traversal via Backup Profile Configuration 0.5%
• CVE-2026-72819 High 8.8 Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload 0.9%
• CVE-2026-69089 High 7.5 Grav CMS before 2.0.11 Path Traversal via watermark 0.5%
• CVE-2026-69088 High 8.1 Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint 0.3%
• CVE-2026-66400 Medium 4.8 Grav Login Plugin before 3.8.13 Insufficient Session Expiration 0.2%
• CVE-2026-65897 High 8.8 Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups 0.5%
• CVE-2026-65896 High 7.1 Grav API Plugin before 1.0.10 Path Traversal via move 0.3%
• CVE-2026-65895 High 8.5 Grav API Plugin before 1.0.10 Broken Access Control 0.3%
• CVE-2026-65608 High 8.8 Grav before 2.0.9 Remote Code Execution via FlexDirectory 1.1%
• CVE-2026-65603 High 8.8 Grav Login Plugin 3.8.11 Privilege Escalation via Profile Update 0.4%
• CVE-2026-65008 Critical 9.8 Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData 2.5%
• CVE-2026-65007 Critical 9.6 Grav before 1.0.8 Missing Authorization on API Key Generation 0.3%
• CVE-2026-64628 Medium 5.4 Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers 0.2%
• CVE-2026-62387 High 7.1 Grav < 1.0.0-rc.16 CORS Misconfiguration via API Plugin 0.3%
• CVE-2026-62386 High 7.5 Grav < 1.0.0-rc.16 Authentication Bypass via token URL Parameter 0.3%
• CVE-2026-62237 Medium 6.5 Grav < 2.0.4 ReDoS via regex_replace in Sandbox 0.3%
• CVE-2026-62236 Medium 5.4 grav-plugin-login < 3.8.11 CSRF via regenerate2FASecret 0.1%
• CVE-2026-62235 Medium 6.3 Grav Flex-Objects < 1.4.3 Authorization Bypass via API 0.3%
• CVE-2026-62234 High 8.1 Grav < 2.0.4 SSRF via Unrestricted cURL Protocols 0.4%
• CVE-2026-62233 High 8.8 grav-plugin-api < 1.0.6 Privilege Escalation via createApiKey 0.4%
• CVE-2026-62232 High 7.4 Grav < 2.0.4 2FA Bypass via Secret Regeneration 0.4%
• CVE-2026-62231 High 8.1 Grav < 1.0.6 API Key Scope Bypass via ApiKeyAuthenticator 0.3%
• CVE-2026-62230 High 7.5 Grav < 2.0.4 File Access Bypass via Case Variation 0.4%
• CVE-2026-61873 High 8.1 Grav before 9.1.8 Arbitrary File Write via Twig-Processed Filename 0.3%
• CVE-2026-61457 High 8.8 Grav before 1.0.3 Remote Code Execution via File Upload Extension Bypass 0.6%
• CVE-2026-61453 Medium 6.1 Grav before 2.0.1 XSS via Twig String Concatenation 0.2%
• CVE-2026-61452 Medium 5.3 Grav before 2.0.4 Improper Session Invalidation JWT Access Tokens 0.2%
• CVE-2026-61449 Medium 6.5 Grav before 2.0.2 Decompression Bomb via Forged ZIP Size 0.3%