Exposure of Grav

CMS
199
exposure score
718
sites use
0
exploited
18
critical

CVEs

162 results
CVE-2026-64850HIGHGrav: Remote code execution via unrestricted callable in Blueprint::dynamicData()EPSS 0.5%CVE-2026-42609HIGHGrav: Administrative Account Disruption and Privilege De-escalation via User Overwrite LogicEPSS 0.5%CVE-2026-69089HIGHGrav CMS before 2.0.11 Path Traversal via watermarkEPSS 0.5%CVE-2026-92917HIGHGrav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_rEPSS 0.5%CVE-2026-65897HIGHGrav API Plugin 1.0.9 Privilege Escalation via Invitations groupsEPSS 0.5%CVE-2026-62668CRITICALGrav API Plugin: Webhook SSRF via Unrestricted cURL ProtocolsEPSS 0.4%CVE-2026-100669HIGHGrav before 2.0.25 Sensitive File Disclosure via Case-Variation BypassEPSS 0.4%CVE-2026-62233HIGHgrav-plugin-api < 1.0.6 Privilege Escalation via createApiKeyEPSS 0.4%CVE-2025-66304MEDIUMGrav Exposes Password Hashes Leading to privilege escalationEPSS 0.4%CVE-2026-61842MEDIUMGrav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)EPSS 0.4%CVE-2026-58654MEDIUMGrav - Arbitrary File Upload via Avatar EndpointEPSS 0.4%CVE-2026-56709HIGHGrav before 3.9.2 Host Header Injection via sendInvitationEmailEPSS 0.4%CVE-2026-72700HIGHGrav before 3.9.1 Timing Attack via Non-Constant-Time Token ComparisonEPSS 0.4%CVE-2026-74907HIGHGrav before 2.0.15 Path Traversal via plugin-asset-map.phpEPSS 0.4%CVE-2026-42841MEDIUMGrav: Stored XSS via Markdown media attribute() action in Grav CMSEPSS 0.4%CVE-2025-66303MEDIUMGrav is vulnerable to a DOS on the admin panelEPSS 0.4%CVE-2025-66305MEDIUMGrav vulnerable to Denial of Service via Improper Input Handling in 'Supported' ParameterEPSS 0.4%CVE-2026-86197MEDIUMGrav before 2.0.20 Cross-Site Scripting via Assets SandboxEPSS 0.4%CVE-2026-72698HIGHGrav CMS before 2.0.16 Information Disclosure via Twig Sandbox BypassEPSS 0.4%CVE-2026-75829HIGHgrav-plugin-api before 1.0.15 Twig SSTI via translate endpointEPSS 0.4%