Login Request a demo
GR
Product
grav-plugin-api
by getgrav · last CVE Oct 19, 2026
15
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Vulnerabilities15In the news0Timeline
Severity mix
Critical 2High 11Medium 2Low 0
Severity
All severities15Critical2High11Medium2Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add grav-plugin-api to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-62666
8.8
1%
Aug 19
Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super
Affected: < 1.0.6
CVE-2026-72833
8.8
0%
Aug 14
Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys
Affected: 1.0.6 through 1.0.11
CVE-2026-42843
8.8
0%
May 11
grav-plugin-api: Grav API Privilege Escalation to Super Admin
Affected: < 1.0.0-beta.15
CVE-2026-86196
8.7
0%
Sep 5
Grav API Plugin before 1.0.20 Authentication Bypass via Host Header
Affected: before 1.0.20
CVE-2026-86195
8.7
0%
Sep 5
grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag
Affected: before 1.0.20
CVE-2026-86193
8.7
0%
Sep 5
Grav API Plugin Authentication Bypass via Group-Inherited Super
Affected: before 1.0.20
CVE-2026-64852
8.7
0%
Aug 19
Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account
Affected: < 1.0.8
CVE-2026-63407
8.2
0%
Aug 19
Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responses
Affected: < 1.0.0-rc.16
CVE-2026-62667
8.1
0%
Aug 19
Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL
Affected: < 1.0.6
CVE-2026-63408
7.5
0%
Aug 19
Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter
Affected: < 1.0.0-rc.16
CVE-2026-109317
7.2
0%
Oct 12
Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants
Affected: before 1.0.36
Showing 11