Getgrav vulnerabilities
212 CVEs and advisories name Getgrav as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-124434Grav Lightbox Gallery 1.1.0 before 1.3.2 File Read via Shortcode Media Actions
- CVE-2026-117604Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback
- CVE-2026-116019Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives
- CVE-2026-114660Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives
- CVE-2026-114659Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes
- CVE-2026-114658Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite
- CVE-2026-114657Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri
- CVE-2026-112782Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service
- CVE-2026-112781Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives
- CVE-2026-112780Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@
- CVE-2026-112779Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass
- CVE-2026-109326Grav before 2.1.7 Information Disclosure via Nested .git Directories
- CVE-2026-109325Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy
- CVE-2026-109324Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms
- CVE-2026-109323Grav Star Ratings 2.0.1 through 2.0.3 Missing Server-Side vote_access Authorization
- CVE-2026-109322Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views
- CVE-2026-109321Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass
- CVE-2026-109320Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass
- CVE-2026-109319Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation
- CVE-2026-109317Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants
- CVE-2026-109316Grav Data Manager 1.4.0 through 1.4.5 Unauthenticated File Deletion via Admin
- CVE-2026-109315Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox
- CVE-2026-109314Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page
- CVE-2026-109313Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie
- CVE-2026-109312Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form
- CVE-2026-100673Grav Data Manager before 1.4.5 Stored XSS via item-detail view
- CVE-2026-100672grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure
- CVE-2026-100671Grav before 2.0.25 Session Cookie Theft via Twig Sandbox
- CVE-2026-100670Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass
- CVE-2026-100669Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypass