Exposure of Grav

CMS
247
exposure score
771
sites use
0
exploited
18
critical
Vexday analysis

O CMS Grav acumula 46 CVEs catalogadas, com 13 surgidas nos últimos 90 dias — volume recente que indica atenção contínua da comunidade de pesquisa à superfície de ataque da plataforma. Nenhuma vulnerabilidade consta no catálogo KEV da CISA, taxa abaixo da média geral do catálogo, o que sugere ausência de exploração ativa confirmada até o momento, embora isso não elimine o risco. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão recorrente em aplicações de gerenciamento de conteúdo. A CVE mais preocupante no cenário atual é CVE-2024-27921, com EPSS de aproximadamente 0,61, indicando probabilidade relevante de exploração — equipes responsáveis por instâncias Grav devem priorizá-la nas verificações de atualização, especialmente considerando que há 3 CVEs de severidade crítica no portfólio total.

CVEs

150 results
CVE-2025-66306MEDIUMGrav vulnerable to Information Disclosure via IDOR in Grav Admin PanelEPSS 0.3%CVE-2026-42610MEDIUMGrav: Sensitive Information Disclosure via Accounts Service BypassEPSS 0.3%CVE-2026-75829HIGHgrav-plugin-api before 1.0.15 Twig SSTI via translate endpointEPSS 0.3%CVE-2020-37256MEDIUMGrav - Cross-Site Scripting in Admin Plugin Page EditorEPSS 0.3%CVE-2026-62235LOWGrav Flex-Objects < 1.4.3 Authorization Bypass via APIEPSS 0.3%CVE-2026-56710CRITICALGrav Login Plugin before 1.0.16 Privilege Escalation via UnlockEPSS 0.3%CVE-2026-44738HIGHGrav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()EPSS 0.3%CVE-2026-76839HIGHGrav before 2.0.16 Information Disclosure via offsetGetEPSS 0.3%CVE-2026-72828HIGHGrav before 1.0.13 API Key Scope Bypass via InvitationsControllerEPSS 0.3%CVE-2026-55885MEDIUMGrav: Admin Backup Zip File Exposes Account Credentials and Configuration SecretsEPSS 0.3%CVE-2026-72829HIGHGrav before 1.0.13 API Key Scope Bypass via UsersControllerEPSS 0.3%CVE-2026-72826HIGHGrav before 1.0.13 Scope Bypass via createApiKeyEPSS 0.3%CVE-2026-72833HIGHGrav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API KeysEPSS 0.3%CVE-2026-86197MEDIUMGrav before 2.0.20 Cross-Site Scripting via Assets SandboxEPSS 0.3%CVE-2026-56709HIGHGrav before 3.9.2 Host Header Injection via sendInvitationEmailEPSS 0.3%CVE-2026-72700HIGHGrav before 3.9.1 Timing Attack via Non-Constant-Time Token ComparisonEPSS 0.3%CVE-2026-64628MEDIUMGrav Stored Cross-Site Scripting via Shortcode Attribute HandlersEPSS 0.3%CVE-2026-72825HIGHGrav before 1.0.13 API-key scope cap bypass via ReportsControllerEPSS 0.2%CVE-2026-76846HIGHGrav before 2.0.16 Information Disclosure via Twig SandboxEPSS 0.2%CVE-2026-72698HIGHGrav CMS before 2.0.16 Information Disclosure via Twig Sandbox BypassEPSS 0.2%