Vulnerabilities in getgrav
211 resultsCVE-2026-86194MEDIUMGrav Form Plugin before 9.1.22 Cross-Page Form ExecutionEPSS 0.6%CVE-2026-72822HIGHGrav before 1.0.13 Authentication Bypass via disable2faEPSS 0.6%CVE-2026-62673HIGHGrav: .htaccess file extension rules bypass via case variation on case-insensitive filesystemsEPSS 0.5%CVE-2026-61690MEDIUMGrav: Decompression Bomb via ZipArchiver - Missing Extraction LimitsEPSS 0.5%CVE-2026-53654MEDIUMGrav: Unauthenticated open redirect via login twofa_cancel _redirectEPSS 0.5%CVE-2026-58492CRITICALgrav-plugin-database: SQL Injection in PDO::tableExists() due to Unsanitized Table Name InterpolationEPSS 0.5%CVE-2026-53653HIGHGrav: Unauthenticated denial of service via unbounded image derivative dimensionsEPSS 0.5%CVE-2025-66302MEDIUMGrav vulnerable to Path Traversal allowing server files backupEPSS 0.5%CVE-2026-80203CRITICALGrav before 1.0.18 Authentication Bypass via Scoped API KeyEPSS 0.5%CVE-2026-56710CRITICALGrav Login Plugin before 1.0.16 Privilege Escalation via UnlockEPSS 0.5%CVE-2026-55890MEDIUMGrav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style()EPSS 0.5%CVE-2026-62669HIGHGrav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending ChallengeEPSS 0.5%CVE-2026-92916HIGHGrav through 2.0.21 Unauthenticated Information Disclosure via ClockworkEPSS 0.5%CVE-2026-72820MEDIUMGrav 2.0.11 Path Traversal via Backup Profile ConfigurationEPSS 0.5%CVE-2026-75837CRITICALGrav before 2.0.14 Privilege Escalation via Group Access FieldEPSS 0.5%CVE-2026-63408HIGHGrav API Plugin: JWT Access Token Accepted via `?token=` URL Query ParameterEPSS 0.5%CVE-2026-72828HIGHGrav before 1.0.13 API Key Scope Bypass via InvitationsControllerEPSS 0.5%CVE-2025-66300HIGHGrav is vulnerable to Arbitrary File ReadEPSS 0.5%CVE-2026-72829HIGHGrav before 1.0.13 API Key Scope Bypass via UsersControllerEPSS 0.5%CVE-2026-72833HIGHGrav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API KeysEPSS 0.5%