getgrav grav-plugin-api vulnerabilities

Newest CVEs

• CVE-2026-112779

  Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass

  getgrav · grav-plugin-api

  Critical9.3
• CVE-2026-109320

  Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass

  getgrav · grav-plugin-api

  Medium5.3
• CVE-2026-109317

  Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants

  getgrav · grav-plugin-api

  High8.6
• CVE-2026-86196

  Grav API Plugin before 1.0.20 Authentication Bypass via Host Header

  getgrav · grav-plugin-api

  High8.7
• CVE-2026-86195

  grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag

  getgrav · grav-plugin-api

  High8.7
• CVE-2026-86193

  Grav API Plugin Authentication Bypass via Group-Inherited Super

  getgrav · grav-plugin-api

  High8.7
• CVE-2026-64852

  Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account

  getgrav · grav-plugin-api

  High8.7
• CVE-2026-63408

  Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter

  getgrav · grav-plugin-api

  High7.5
• CVE-2026-63407

  Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responses

  getgrav · grav-plugin-api

  High8.2
• CVE-2026-62667

  Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL

  getgrav · grav-plugin-api

  High8.1