grav-plugin-api vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

GR

Product

grav-plugin-api

by getgrav · last CVE Oct 19, 2026

15

CVEs

0

On KEV

9.8

Max CVSS

3

New 30D

Vulnerabilities15 In the news0 Timeline

Severity mix

Critical 2High 11Medium 2Low 0

Severity

All severities15 Critical2 High11 Medium2 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add grav-plugin-api to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-112779	9.8	1%	Oct 19	Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass Affected: 1.0.16 before 1.0.42
CVE-2026-62668	9.4	0%	Aug 19	Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols Affected: < 1.0.6
CVE-2026-62666	8.8	1%	Aug 19	Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super Affected: < 1.0.6
CVE-2026-72833	8.8	0%	Aug 14	Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys Affected: 1.0.6 through 1.0.11
CVE-2026-42843	8.8	0%	May 11	grav-plugin-api: Grav API Privilege Escalation to Super Admin Affected: < 1.0.0-beta.15
CVE-2026-86196	8.7	0%	Sep 5	Grav API Plugin before 1.0.20 Authentication Bypass via Host Header Affected: before 1.0.20
CVE-2026-86195	8.7	0%	Sep 5	grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag Affected: before 1.0.20
CVE-2026-86193	8.7	0%	Sep 5	Grav API Plugin Authentication Bypass via Group-Inherited Super Affected: before 1.0.20
CVE-2026-64852	8.7	0%	Aug 19	Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account Affected: < 1.0.8
CVE-2026-63407	8.2	0%	Aug 19	Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responses Affected: < 1.0.0-rc.16
CVE-2026-62667	8.1	0%	Aug 19	Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL Affected: < 1.0.6
CVE-2026-63408	7.5	0%	Aug 19	Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter Affected: < 1.0.0-rc.16
CVE-2026-109317	7.2	0%	Oct 12	Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants Affected: before 1.0.36
CVE-2026-109320	5.4	0%	Oct 12	Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass Affected: before 1.0.36
CVE-2026-61607	4.6	0%	Aug 19	Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer Affected: < 1.0.2