GE
Vendor
getgrav
231
CVEs
0
On KEV
24
New 30D
Products
GR9.9
grav
getgrav
175 CVEs0 on KEV11 new
GR9.8
grav-plugin-api
getgrav
15 CVEs0 on KEV3 new
GR8.8
grav-plugin-login
getgrav
7 CVEs0 on KEV4 new
GR9.1
grav-plugin-login-oauth
getgrav
1 CVEs0 on KEV1 new
GR6.1
grav-plugin-guestbook
getgrav
2 CVEs0 on KEV2 new
GR6.5
grav-plugin-flex-objects
getgrav
2 CVEs0 on KEV1 new
GR6.5
grav-plugin-data-manager
getgrav
1 CVEs0 on KEV1 new
GR5.3
grav-plugin-star-ratings
getgrav
1 CVEs0 on KEV1 new
GR9.8
grav-plugin-admin
getgrav
10 CVEs0 on KEV0 new
GC8.8
Grav Cms
Getgrav
5 CVEs0 on KEV0 new
GR7.7
grav-plugin-form
getgrav
5 CVEs0 on KEV0 new
GR8.5
grav-plugin-shortcode-core
getgrav
2 CVEs0 on KEV0 new
DO6.1
Dom-sanitizer
Getgrav
1 CVEs0 on KEV0 new
GA7.2
Grav Admin
Getgrav
1 CVEs0 on KEV0 new
GR5.4
grav-plugin-admin2
getgrav
1 CVEs0 on KEV0 new
GR7.5
grav-plugin-comments
getgrav
1 CVEs0 on KEV0 new
GR8.2
grav-plugin-datamanager
getgrav
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-117604 New | GR grav getgrav | 7.5 | Oct 27 | Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback |
| CVE-2026-116019 New | GR grav getgrav | 8.8 | Oct 24 | Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives |
| CVE-2026-114660 New | GR grav getgrav | 6.3 | Oct 22 | Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives |
| CVE-2026-114659 New | GR grav-plugin-flex-objects getgrav | 6.5 | Oct 22 | Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes |
| CVE-2026-114658 New | GR grav-plugin-login getgrav | 8.8 | Oct 22 | Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite |
| CVE-2026-114657 New | GR grav getgrav | 5.7 | Oct 22 | Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri |
| CVE-2026-112782 | GR grav getgrav | 7.5 | Oct 19 | Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service |
| CVE-2026-112781 | GR grav getgrav | 6.5 | Oct 19 | Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives |
| CVE-2026-112780 | GR grav getgrav | 8.8 | Oct 19 | Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@ |
| CVE-2026-112779 | GR grav-plugin-api getgrav | 9.8 | Oct 19 | Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass |
| CVE-2026-109326 | GR grav getgrav | 7.5 | Oct 12 | Grav before 2.1.7 Information Disclosure via Nested .git Directories |
| CVE-2026-109325 | GR grav getgrav | 7.5 | Oct 12 | Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy |
| CVE-2026-109324 | GR grav getgrav | 6.5 | Oct 12 | Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms |
| CVE-2026-109323 | GR grav-plugin-star-ratings getgrav | 5.3 | Oct 12 | Grav Star Ratings 2.0.1 through 2.0.3 Missing Server-Side vote_access Authorization |
| CVE-2026-109322 | GR grav-plugin-guestbook getgrav | 6.1 | Oct 12 | Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views |
| CVE-2026-109321 | GR grav-plugin-login-oauth getgrav | 9.1 | Oct 12 | Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass |
| CVE-2026-109320 | GR grav-plugin-api getgrav | 5.4 | Oct 12 | Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass |
| CVE-2026-109319 | GR grav-plugin-guestbook getgrav | 4.3 | Oct 12 | Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation |
| CVE-2026-109317 | GR grav-plugin-api getgrav | 7.2 | Oct 12 | Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants |
| CVE-2026-109316 | GR grav-plugin-data-manager getgrav | 6.5 | Oct 12 | Grav Data Manager 1.4.0 through 1.4.5 Unauthenticated File Deletion via Admin |
| CVE-2026-109315 | GR grav getgrav | 6.5 | Oct 12 | Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox |
| CVE-2026-109314 | GR grav-plugin-login getgrav | 7.3 | Oct 12 | Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page |
| CVE-2026-109313 | GR grav-plugin-login getgrav | 8.1 | Oct 12 | Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie |
| CVE-2026-109312 | GR grav-plugin-login getgrav | 8.1 | Oct 12 | Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form |
| CVE-2026-100673 | GR grav-plugin-datamanager getgrav | 8.2 | Sep 26 | Grav Data Manager before 1.4.5 Stored XSS via item-detail view |
| CVE-2026-100672 | GR grav-plugin-comments getgrav | 7.5 | Sep 26 | grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure |
| CVE-2026-100671 | GR grav getgrav | 8.0 | Sep 26 | Grav before 2.0.25 Session Cookie Theft via Twig Sandbox |
| CVE-2026-100670 | GR grav getgrav | 8.8 | Sep 26 | Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass |
| CVE-2026-100669 | GR grav getgrav | 7.5 | Sep 26 | Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypass |
| CVE-2026-100668 | GR grav getgrav | 6.5 | Sep 26 | Grav before 2.0.25 Sandbox Escape via array Filter |
| CVE-2026-100667 | GR grav getgrav | 5.3 | Sep 26 | grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass |
| CVE-2026-92917 | GR grav getgrav | 7.5 | Sep 17 | Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r |
| CVE-2026-92916 | GR grav getgrav | 7.5 | Sep 17 | Grav through 2.0.21 Unauthenticated Information Disclosure via Clockwork |
| CVE-2025-64059 | GR Grav getgrav | 1.8 | Sep 13 | Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor |
| CVE-2026-86197 | GR grav getgrav | 5.1 | Sep 5 | Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox |
| CVE-2026-86196 | GR grav-plugin-api getgrav | 8.7 | Sep 5 | Grav API Plugin before 1.0.20 Authentication Bypass via Host Header |
| CVE-2026-86195 | GR grav-plugin-api getgrav | 8.7 | Sep 5 | grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag |
| CVE-2026-86194 | GR grav-plugin-form getgrav | 6.9 | Sep 5 | Grav Form Plugin before 9.1.22 Cross-Page Form Execution |
| CVE-2026-86193 | GR grav-plugin-api getgrav | 8.7 | Sep 5 | Grav API Plugin Authentication Bypass via Group-Inherited Super |
| CVE-2026-85604 | GR grav getgrav | 8.8 | Sep 4 | Grav before 2.0.18 Remote Code Execution via sort filter |
| CVE-2026-85603 | GR grav getgrav | 6.5 | Sep 4 | Grav Admin Plugin Path Traversal via Save As Language Code |
| CVE-2026-85602 | GR grav-plugin-form getgrav | 5.3 | Sep 4 | Grav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication Bypass |
| CVE-2026-85601 | GR grav getgrav | 5.4 | Sep 4 | Grav Admin before 2.0.20 Cross-Site Scripting via marked.js |
| CVE-2026-85600 | GR grav-plugin-admin2 getgrav | 5.4 | Sep 4 | Grav Admin before 2.0.21 Stored XSS via username |
| CVE-2026-85599 | GR grav-plugin-shortcode-core getgrav | 7.2 | Sep 4 | Grav Shortcode Core before 6.2.5 Stored XSS via unescaped parameters |
| CVE-2026-85598 | GR grav getgrav | 6.4 | Sep 4 | Grav 2.0.0 through 2.0.17 Stored XSS via Modular Pages |
| CVE-2026-80204 | GR grav getgrav | 5.4 | Aug 26 | Grav before 1.0.18 Authentication Bypass via Scoped API Key |
| CVE-2026-80203 | GR grav getgrav | 9.8 | Aug 26 | Grav before 1.0.18 Authentication Bypass via Scoped API Key |
| CVE-2026-76846 | GR grav getgrav | 7.5 | Aug 25 | Grav before 2.0.16 Information Disclosure via Twig Sandbox |
| CVE-2026-76839 | GR grav getgrav | 6.5 | Aug 25 | Grav before 2.0.16 Information Disclosure via offsetGet |
| CVE-2026-75574 | GR grav getgrav | 8.8 | Aug 25 | Grav before 4.2.2 Remote Code Execution via Email Twig |
| CVE-2026-72702 | GR grav getgrav | 5.4 | Aug 25 | Grav CMS before 2.0.16 Origin Validation Bypass via Referer |
| CVE-2026-72701 | GR grav getgrav | 3.7 | Aug 25 | Grav CMS before 2.0.16 Timing Attack via verifyNonce |
| CVE-2026-72700 | GR grav getgrav | 7.5 | Aug 25 | Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparison |
| CVE-2026-72699 | GR grav-plugin-login getgrav | 5.3 | Aug 25 | Grav Login Plugin before 3.9.1 Email Enumeration via Registration |
| CVE-2026-72698 | GR grav getgrav | 6.5 | Aug 25 | Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass |
| CVE-2026-72697 | GR grav getgrav | 6.5 | Aug 25 | Grav CMS before 2.0.16 Path Traversal via media_directory |
| CVE-2026-72696 | GR grav getgrav | 8.4 | Aug 25 | Grav CMS before 2.0.16 Symlink Following via createLockFile |
| CVE-2026-72695 | GR grav getgrav | 8.1 | Aug 25 | Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile |
| CVE-2026-56710 | GR grav getgrav | 9.8 | Aug 25 | Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock |