Vulnerabilities in getgrav
211 resultsCVE-2026-72833HIGHGrav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API KeysEPSS 0.5%CVE-2026-75836HIGHGrav API Plugin before 1.0.14 Missing AuthorizationEPSS 0.5%CVE-2026-64850HIGHGrav: Remote code execution via unrestricted callable in Blueprint::dynamicData()EPSS 0.5%CVE-2026-42609HIGHGrav: Administrative Account Disruption and Privilege De-escalation via User Overwrite LogicEPSS 0.5%CVE-2026-64851HIGHGrav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlersEPSS 0.5%CVE-2026-69089HIGHGrav CMS before 2.0.11 Path Traversal via watermarkEPSS 0.5%CVE-2026-65897HIGHGrav API Plugin 1.0.9 Privilege Escalation via Invitations groupsEPSS 0.5%CVE-2026-92917HIGHGrav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_rEPSS 0.5%CVE-2026-62668CRITICALGrav API Plugin: Webhook SSRF via Unrestricted cURL ProtocolsEPSS 0.4%CVE-2026-100669HIGHGrav before 2.0.25 Sensitive File Disclosure via Case-Variation BypassEPSS 0.4%CVE-2026-62233HIGHgrav-plugin-api < 1.0.6 Privilege Escalation via createApiKeyEPSS 0.4%CVE-2025-66304MEDIUMGrav Exposes Password Hashes Leading to privilege escalationEPSS 0.4%CVE-2026-61842MEDIUMGrav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)EPSS 0.4%CVE-2026-86196HIGHGrav API Plugin before 1.0.20 Authentication Bypass via Host HeaderEPSS 0.4%CVE-2026-56709HIGHGrav before 3.9.2 Host Header Injection via sendInvitationEmailEPSS 0.4%CVE-2026-74907HIGHGrav before 2.0.15 Path Traversal via plugin-asset-map.phpEPSS 0.4%CVE-2026-72700HIGHGrav before 3.9.1 Timing Attack via Non-Constant-Time Token ComparisonEPSS 0.4%CVE-2026-42841MEDIUMGrav: Stored XSS via Markdown media attribute() action in Grav CMSEPSS 0.4%CVE-2025-66303MEDIUMGrav is vulnerable to a DOS on the admin panelEPSS 0.4%CVE-2025-66305MEDIUMGrav vulnerable to Denial of Service via Improper Input Handling in 'Supported' ParameterEPSS 0.4%