getgrav vulnerabilities

CVEs per yearBy the year they were published

1. 20225
2. 20236
3. 20247
4. 202520
5. 2026163
6. 20269
7. 20261

Newest CVEs

• CVE-2026-117604

  Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback

  getgrav · grav

  High8.7
• CVE-2026-116019

  Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives

  getgrav · grav

  High8.7
• CVE-2026-114660

  Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives

  getgrav · grav

  High7.0
• CVE-2026-114659

  Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes

  getgrav · grav-plugin-flex-objects

  High7.1
• CVE-2026-114658

  Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite

  getgrav · grav-plugin-login

  High8.7
• CVE-2026-114657

  Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri

  getgrav · grav

  Medium6.9
• CVE-2026-112782

  Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service

  getgrav · grav

  High8.7
• CVE-2026-112781

  Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives

  getgrav · grav

  High8.7
• CVE-2026-112780

  Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@

  getgrav · grav

  Critical9.3
• CVE-2026-112779

  Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass

  getgrav · grav-plugin-api

  Critical9.3