Vulnerabilities in getgrav
211 resultsCVE-2026-65007HIGHGrav before 1.0.8 Missing Authorization on API Key GenerationEPSS 0.3%CVE-2026-72823MEDIUMGrav before 1.0.13 API-key scope cap bypass via DemoControllerEPSS 0.3%CVE-2026-65896HIGHGrav API Plugin before 1.0.10 Path Traversal via moveEPSS 0.3%CVE-2026-44737MEDIUMgrav-plugin-admin: Stored Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][title]EPSS 0.3%CVE-2026-109324HIGHGrav before 2.1.7 Memory Exhaustion via Oversized Image TransformsEPSS 0.3%CVE-2025-66306MEDIUMGrav vulnerable to Information Disclosure via IDOR in Grav Admin PanelEPSS 0.3%CVE-2026-72832MEDIUMGrav before 2.0.13 Stored XSS via quoted-attribute bypassEPSS 0.3%CVE-2026-62387HIGHGrav < 1.0.0-rc.16 CORS Misconfiguration via API PluginEPSS 0.3%CVE-2026-61451CRITICALGrav API Plugin before 1.0.4 Password Reset Token Poisoning via admin_base_urlEPSS 0.3%CVE-2026-61873HIGHGrav before 9.1.8 Arbitrary File Write via Twig-Processed FilenameEPSS 0.3%CVE-2026-61454HIGHGrav before 2.0.4 Information Disclosure via __GRAV_CONFIG__EPSS 0.3%CVE-2026-75835CRITICALGrav API Plugin before 1.0.14 Missing AuthorizationEPSS 0.3%CVE-2026-117604HIGHGrav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback FallbackEPSS 0.3%CVE-2026-100667MEDIUMgrav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication BypassEPSS 0.3%CVE-2026-76846HIGHGrav before 2.0.16 Information Disclosure via Twig SandboxEPSS 0.3%CVE-2026-62237MEDIUMGrav < 2.0.4 ReDoS via regex_replace in SandboxEPSS 0.3%CVE-2026-61455HIGHGrav before 2.0.1 Decompression Bomb via ZipArchiverEPSS 0.3%CVE-2026-42611HIGHGrav: Stored XSS via Tag InjectionEPSS 0.3%CVE-2026-61449HIGHGrav before 2.0.2 Decompression Bomb via Forged ZIP SizeEPSS 0.3%CVE-2026-75832CRITICALGrav API Plugin before 1.0.14 Authorization BypassEPSS 0.3%