[ Vendor · 29 CVEs ]
getgrav
CVEs affecting getgrav published in the last 30 days, plus any getgrav CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114660 | 22 Oct 2026 | CVSS 6.3 | getgrav gravGrav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call… | |
| CVE-2026-114657 | 22 Oct 2026 | CVSS 5.7 | getgrav gravGrav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credentials… | |
| CVE-2026-114658 | 22 Oct 2026 | CVSS 8.8 | getgrav grav-plugin-loginGrav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain… | |
| CVE-2026-114659 | 22 Oct 2026 | CVSS 6.5 | getgrav grav-plugin-flex-objectsGrav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only… | |
| CVE-2026-112779 | 19 Oct 2026 | CVSS 9.8 | getgrav grav-plugin-apiGrav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the… | |
| CVE-2026-112780 | 19 Oct 2026 | CVSS 8.8 | getgrav gravGrav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming… | |
| CVE-2026-112781 | 19 Oct 2026 | CVSS 6.5 | getgrav gravGrav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding… | |
| CVE-2026-112782 | 19 Oct 2026 | CVSS 7.5 | getgrav gravGrav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the… | |
| CVE-2026-109326 | 12 Oct 2026 | CVSS 7.5 | getgrav gravGrav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only… | |
| CVE-2026-109320 | 12 Oct 2026 | CVSS 5.4 | getgrav grav-plugin-apiThe Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API… | |
| CVE-2026-109321 | 12 Oct 2026 | CVSS 9.1 | getgrav grav-plugin-login-oauthGrav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id>… | |
| CVE-2026-109322 | 12 Oct 2026 | CVSS 6.1 | getgrav grav-plugin-guestbookGrav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert… | |
| CVE-2026-109323 | 12 Oct 2026 | CVSS 5.3 | getgrav grav-plugin-star-ratingsGrav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing… | |
| CVE-2026-109324 | 12 Oct 2026 | CVSS 6.5 | getgrav gravGrav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed… | |
| CVE-2026-109325 | 12 Oct 2026 | CVSS 7.5 | getgrav gravGrav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values… | |
| CVE-2026-109313 | 12 Oct 2026 | CVSS 8.1 | getgrav grav-plugin-loginGrav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor… | |
| CVE-2026-109314 | 12 Oct 2026 | CVSS 7.3 | getgrav grav-plugin-loginGrav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by… | |
| CVE-2026-109315 | 12 Oct 2026 | CVSS 6.5 | getgrav gravGrav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because… | |
| CVE-2026-109316 | 12 Oct 2026 | CVSS 6.5 | getgrav grav-plugin-data-managerGrav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored… | |
| CVE-2026-109317 | 12 Oct 2026 | CVSS 7.2 | getgrav grav-plugin-apiGrav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by… | |
| CVE-2026-109319 | 12 Oct 2026 | CVSS 4.3 | getgrav grav-plugin-guestbookGrav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions… | |
| CVE-2026-109312 | 12 Oct 2026 | CVSS 8.1 | getgrav grav-plugin-loginGrav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not… | |
| CVE-2026-100673 | 26 Sep 2026 | CVSS 8.2 | getgrav grav-plugin-datamanagerThe Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view… | |
| CVE-2026-100667 | 26 Sep 2026 | CVSS 5.3 | getgrav gravgrav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challenge to be bypassed for content… | |
| CVE-2026-100668 | 26 Sep 2026 | CVSS 6.5 | getgrav gravGrav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The `array` filter (and its identical function form) is on the sandbox allowlist but… | |
| CVE-2026-100669 | 26 Sep 2026 | CVSS 7.5 | getgrav gravGrav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively. In… | |
| CVE-2026-100670 | 26 Sep 2026 | CVSS 8.8 | getgrav gravGrav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a… | |
| CVE-2026-100671 | 26 Sep 2026 | CVSS 8.0 | getgrav gravGrav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly… | |
| CVE-2026-100672 | 26 Sep 2026 | CVSS 7.5 | getgrav grav-plugin-commentsThe Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON… |