What’s Vulnerable › Products
getgrav grav vulnerabilities
176 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 151 published in the last 12 months.
Check whether your getgrav grav version is affected
Latest getgrav grav vulnerabilities
- CVE-2026-117604 — Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback (CVSS 7.5)
- CVE-2026-116019 — Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives (CVSS 8.8)
- CVE-2026-114660 — Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives (CVSS 6.3)
- CVE-2026-114657 — Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri (CVSS 5.7)
- CVE-2026-112782 — Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service (CVSS 7.5)
- CVE-2026-112781 — Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives (CVSS 6.5)
- CVE-2026-112780 — Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@ (CVSS 8.8)
- CVE-2026-109326 — Grav before 2.1.7 Information Disclosure via Nested .git Directories (CVSS 7.5)
- CVE-2026-109325 — Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy (CVSS 7.5)
- CVE-2026-109324 — Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms (CVSS 6.5)
- CVE-2026-109315 — Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox (CVSS 6.5)
- CVE-2026-100671 — Grav before 2.0.25 Session Cookie Theft via Twig Sandbox (CVSS 8.0)
- CVE-2026-100670 — Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass (CVSS 8.8)
- CVE-2026-100669 — Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypass (CVSS 7.5)
- CVE-2026-100668 — Grav before 2.0.25 Sandbox Escape via array Filter (CVSS 6.5)
- CVE-2026-100667 — grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass (CVSS 5.3)
- CVE-2026-92917 — Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r (CVSS 7.5)
- CVE-2026-92916 — Grav through 2.0.21 Unauthenticated Information Disclosure via Clockwork (CVSS 7.5)
- CVE-2025-64059 — (CVSS 1.8)
- CVE-2026-86197 — Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox (CVSS 5.1)
- CVE-2026-85604 — Grav before 2.0.18 Remote Code Execution via sort filter (CVSS 8.8)
- CVE-2026-85603 — Grav Admin Plugin Path Traversal via Save As Language Code (CVSS 6.5)
- CVE-2026-85601 — Grav Admin before 2.0.20 Cross-Site Scripting via marked.js (CVSS 5.4)
- CVE-2026-85598 — Grav 2.0.0 through 2.0.17 Stored XSS via Modular Pages (CVSS 6.4)
- CVE-2026-80204 — Grav before 1.0.18 Authentication Bypass via Scoped API Key (CVSS 5.4)