Vulnerabilities in getgrav
211 resultsCVE-2026-109315HIGHGrav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig SandboxEPSS 0.3%CVE-2026-100673HIGHGrav Data Manager before 1.4.5 Stored XSS via item-detail viewEPSS 0.3%CVE-2026-69088HIGHGrav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via BlueprintEPSS 0.3%CVE-2026-65895HIGHGrav API Plugin before 1.0.10 Broken Access ControlEPSS 0.3%CVE-2026-42610MEDIUMGrav: Sensitive Information Disclosure via Accounts Service BypassEPSS 0.3%CVE-2026-61607MEDIUMGrav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses SanitizerEPSS 0.3%CVE-2026-62235LOWGrav Flex-Objects < 1.4.3 Authorization Bypass via APIEPSS 0.3%CVE-2026-109314HIGHGrav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset PageEPSS 0.3%CVE-2026-56708MEDIUMGrav API Plugin before 1.0.16 SSRF via DNS RebindingEPSS 0.3%CVE-2026-100668HIGHGrav before 2.0.25 Sandbox Escape via array FilterEPSS 0.3%CVE-2026-62231HIGHGrav < 1.0.6 API Key Scope Bypass via ApiKeyAuthenticatorEPSS 0.3%CVE-2026-85601MEDIUMGrav Admin before 2.0.20 Cross-Site Scripting via marked.jsEPSS 0.3%CVE-2026-44738HIGHGrav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()EPSS 0.3%CVE-2026-59190HIGHGrav Admin Plugin — IDOR Privilege Escalation via saveUser()EPSS 0.3%CVE-2026-109316MEDIUMGrav Data Manager 1.4.0 through 1.4.5 Unauthenticated File Deletion via AdminEPSS 0.3%CVE-2026-114658HIGHGrav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.inviteEPSS 0.3%CVE-2026-85599MEDIUMGrav Shortcode Core before 6.2.5 Stored XSS via unescaped parametersEPSS 0.3%CVE-2026-109323MEDIUMGrav Star Ratings 2.0.1 through 2.0.3 Missing Server-Side vote_access AuthorizationEPSS 0.3%CVE-2026-72699CRITICALGrav Login Plugin before 3.9.1 Email Enumeration via RegistrationEPSS 0.3%CVE-2026-85598MEDIUMGrav 2.0.0 through 2.0.17 Stored XSS via Modular PagesEPSS 0.3%