Getgrav vulnerabilities
212 CVEs and advisories name Getgrav as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-100668Grav before 2.0.25 Sandbox Escape via array Filter
- CVE-2026-100667grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass
- CVE-2026-92917Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r
- CVE-2026-92916Grav through 2.0.21 Unauthenticated Information Disclosure via Clockwork
- CVE-2025-64059Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor.
- CVE-2026-86197Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox
- CVE-2026-86196Grav API Plugin before 1.0.20 Authentication Bypass via Host Header
- CVE-2026-86195grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag
- CVE-2026-86194Grav Form Plugin before 9.1.22 Cross-Page Form Execution
- CVE-2026-86193Grav API Plugin Authentication Bypass via Group-Inherited Super
- CVE-2026-85604Grav before 2.0.18 Remote Code Execution via sort filter
- CVE-2026-85603Grav Admin Plugin Path Traversal via Save As Language Code
- CVE-2026-85602Grav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication Bypass
- CVE-2026-85601Grav Admin before 2.0.20 Cross-Site Scripting via marked.js
- CVE-2026-85600Grav Admin before 2.0.21 Stored XSS via username
- CVE-2026-85599Grav Shortcode Core before 6.2.5 Stored XSS via unescaped parameters
- CVE-2026-85598Grav 2.0.0 through 2.0.17 Stored XSS via Modular Pages
- CVE-2026-80204Grav before 1.0.18 Authentication Bypass via Scoped API Key
- CVE-2026-80203Grav before 1.0.18 Authentication Bypass via Scoped API Key
- CVE-2026-76846Grav before 2.0.16 Information Disclosure via Twig Sandbox
- CVE-2026-76839Grav before 2.0.16 Information Disclosure via offsetGet
- CVE-2026-75574Grav before 4.2.2 Remote Code Execution via Email Twig
- CVE-2026-72702Grav CMS before 2.0.16 Origin Validation Bypass via Referer
- CVE-2026-72701Grav CMS before 2.0.16 Timing Attack via verifyNonce
- CVE-2026-72700Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparison
- CVE-2026-72699Grav Login Plugin before 3.9.1 Email Enumeration via Registration
- CVE-2026-72698Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass
- CVE-2026-72697Grav CMS before 2.0.16 Path Traversal via media_directory
- CVE-2026-72696Grav CMS before 2.0.16 Symlink Following via createLockFile
- CVE-2026-72695Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile