GR
Product
grav
181
CVEs
0
On KEV
9.9
Max CVSS
11
New 30D
Severity mix
Critical 16High 87Medium 76Low 2
Watch
Add grav to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-1173 | 5.4 | Apr 26 | stored xss in GitHub repository getgrav/grav prior to 1.7.33 Affected: before 1.7.33 |
| CVE-2022-0970 | 5.4 | Mar 15 | Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31 Affected: before 1.7.31 |
| CVE-2022-0268 | 5.4 | Jan 25 | Cross-site Scripting (XSS) - Stored in Packagist getgrav/grav prior to 1.7.28 Affected: before 1.7.28 |
| CVE-2021-3904 | 5.4 | Oct 27 | grav is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected: before 1.7.24 |
| CVE-2026-100667 | 5.3 | Sep 26 | grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass Affected: 3.8.7 before 3.9.7 |
| CVE-2026-56708 | 5.3 | Aug 25 | Grav API Plugin before 1.0.16 SSRF via DNS Rebinding Affected: before 1.0.16 |
| CVE-2026-53654 | 5.3 | Aug 19 | Grav: Unauthenticated open redirect via login twofa_cancel _redirect Affected: < 3.8.5 |
| CVE-2026-61452 | 5.3 | Jul 15 | Grav before 2.0.4 Improper Session Invalidation JWT Access Tokens Affected: before 2.0.4 |
| CVE-2026-61454 | 5.3 | Jul 11 | Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__ Affected: before 2.0.4 |
| CVE-2025-66307 | 5.3 | Dec 1 | Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure Affected: < 1.11.0-beta.1 |
| CVE-2021-3818 | 5.3 | Sep 27 | grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking Affected: before 1.7.22 |
| CVE-2026-86197 | 5.1 | Sep 5 | Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox Affected: before 2.0.20 |
| CVE-2026-58493 | 5.1 | Jul 10 | grav-plugin-database: DSN Parameter Injection via Unsanitized Configuration Values in Connection String Construction Affected: < 1.2.0 |
| CVE-2026-72820 | 4.9 | Aug 14 | Grav 2.0.11 Path Traversal via Backup Profile Configuration Affected: 2.0.11 before 2.0.13 |
| CVE-2026-59193 | 4.9 | Jul 10 | Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip() Affected: >= 1.0.0, < 2.0.0 |
| CVE-2025-66305 | 4.9 | Dec 1 | Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter Affected: < 1.8.0-beta.27 |
| CVE-2025-66303 | 4.9 | Dec 1 | Grav is vulnerable to a DOS on the admin panel Affected: < 1.8.0-beta.27 |
| CVE-2026-66400 | 4.8 | Jul 29 | Grav Login Plugin before 3.8.13 Insufficient Session Expiration Affected: before 3.8.13 |
| CVE-2026-55890 | 4.8 | Jul 10 | Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() Affected: < 2.0.0-rc.9 |
| CVE-2026-42841 | 4.8 | May 11 | Grav: Stored XSS via Markdown media attribute() action in Grav CMS Affected: < 2.0.0-beta.2 |
| CVE-2026-74908 | 4.6 | Aug 18 | Grav plugin-api before 1.0.15 Script Injection via SVG Affected: before 1.0.15 |
| CVE-2026-61456 | 4.6 | Jul 10 | Grav before 1.0.3 Stored XSS via SVG Upload API Affected: before 1.0.3 |
| CVE-2022-0743 | 4.6 | Feb 28 | Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31 Affected: before 1.7.31 |
| CVE-2026-75835 | 4.3 | Aug 18 | Grav API Plugin before 1.0.14 Missing Authorization Affected: before 1.0.14 |
| CVE-2026-75832 | 4.3 | Aug 18 | Grav API Plugin before 1.0.14 Authorization Bypass Affected: before 1.0.14 |
| CVE-2026-75833 | 4.2 | Aug 18 | Grav API Plugin Open Redirect via Backslash Bypass Affected: before 1.0.14 |