Vulnerabilities in getgrav
211 resultsCVE-2026-100671HIGHGrav before 2.0.25 Session Cookie Theft via Twig SandboxEPSS 0.4%CVE-2026-58493MEDIUMgrav-plugin-database: DSN Parameter Injection via Unsanitized Configuration Values in Connection String ConstructionEPSS 0.4%CVE-2026-86193HIGHGrav API Plugin Authentication Bypass via Group-Inherited SuperEPSS 0.4%CVE-2026-85602CRITICALGrav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication BypassEPSS 0.4%CVE-2026-109317HIGHGrav API Plugin before 1.0.36 Privilege Escalation via Scalar Access GrantsEPSS 0.4%CVE-2026-58656HIGHGrav API Plugin - Cross-Origin Admin Account Takeover via CORS Wildcard and JWT Query ParameterEPSS 0.4%CVE-2026-62232CRITICALGrav < 2.0.4 2FA Bypass via Secret RegenerationEPSS 0.4%CVE-2026-109312HIGHGrav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update FormEPSS 0.4%CVE-2026-109313HIGHGrav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me CookieEPSS 0.4%CVE-2026-42843HIGHgrav-plugin-api: Grav API Privilege Escalation to Super AdminEPSS 0.4%CVE-2026-75831MEDIUMGrav before 2.0.15 Stored XSS via audio/video source URLEPSS 0.4%CVE-2026-116019HIGHGrav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override DirectivesEPSS 0.3%CVE-2026-109326HIGHGrav before 2.1.7 Information Disclosure via Nested .git DirectoriesEPSS 0.3%CVE-2026-72825HIGHGrav API Plugin before 1.0.13 API-key scope cap bypass via ReportsControllerEPSS 0.3%CVE-2026-76839HIGHGrav before 2.0.16 Information Disclosure via offsetGetEPSS 0.3%CVE-2025-66296HIGHGrav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account TakeoverEPSS 0.3%CVE-2025-66307MEDIUMGrav Admin Plugin vulnerable to User Enumeration & Email DisclosureEPSS 0.3%CVE-2026-42844HIGHGrav: Low-privileged API users can create super-admin accounts via blueprint-uploadEPSS 0.3%CVE-2026-62386HIGHGrav < 1.0.0-rc.16 Authentication Bypass via token URL ParameterEPSS 0.3%CVE-2026-62670MEDIUMFail-open authorization in grav-plugin-flex-objects admin-next API: api.access user gets full CRUD on permission-less directories (requireFlexPermission missing else-deny)EPSS 0.3%