Vulnerabilities in getgrav
211 resultsCVE-2025-66305MEDIUMGrav vulnerable to Denial of Service via Improper Input Handling in 'Supported' ParameterEPSS 0.4%CVE-2026-62667HIGHGrav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACLEPSS 0.4%CVE-2026-86197MEDIUMGrav before 2.0.20 Cross-Site Scripting via Assets SandboxEPSS 0.4%CVE-2026-72698HIGHGrav CMS before 2.0.16 Information Disclosure via Twig Sandbox BypassEPSS 0.4%CVE-2026-75829HIGHgrav-plugin-api before 1.0.15 Twig SSTI via translate endpointEPSS 0.4%CVE-2025-66298HIGHGrav is vulnerable to Server-Side Template Injection (SSTI) via FormsEPSS 0.4%CVE-2026-109325HIGHGrav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via ProxyEPSS 0.4%CVE-2026-109321CRITICALGrav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication BypassEPSS 0.4%CVE-2026-75830HIGHgrav-plugin-api before 1.0.15 Path Traversal via batchCopyEPSS 0.4%CVE-2026-75828CRITICALGrav before 2.0.15 Stored XSS via detectXss() Quote BypassEPSS 0.4%CVE-2026-86195HIGHgrav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super FlagEPSS 0.4%CVE-2026-65603HIGHGrav Login Plugin 3.8.11 Privilege Escalation via Profile UpdateEPSS 0.4%CVE-2026-100670HIGHGrav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard BypassEPSS 0.4%CVE-2026-62230HIGHGrav < 2.0.4 File Access Bypass via Case VariationEPSS 0.4%CVE-2026-62672MEDIUMGrav: Authenticated ReDoS via regex_replace in Twig SandboxEPSS 0.4%CVE-2026-72697HIGHGrav CMS before 2.0.16 Path Traversal via media_directoryEPSS 0.4%CVE-2026-63407HIGHGrav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API ResponsesEPSS 0.4%CVE-2026-56707HIGHGrav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via ShortcodeEPSS 0.4%CVE-2026-69087HIGHGrav Form Plugin before 9.1.13 Open Redirect via form.value() TwigEPSS 0.4%CVE-2026-62234HIGHGrav < 2.0.4 SSRF via Unrestricted cURL ProtocolsEPSS 0.4%