CVE-2026-92917Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r Exploitation status Not confirmed Fix Published 09/17/2026 Severity High CVE-2026-92916Grav through 2.0.21 Unauthenticated Information Disclosure via Clockwork Exploitation status Not known exploited Fix Published 09/17/2026 Severity High CVE-2025-64059Exploitation status Public exploit Fix Not confirmed Published 09/13/2026 Severity Low CVE-2026-86197Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox Exploitation status Not known exploited Fix Published 09/05/2026 Severity Medium CVE-2026-85604Grav before 2.0.18 Remote Code Execution via sort filter Exploitation status Public exploit Fix Published 09/04/2026 Severity High CVE-2026-85603Grav Admin Plugin Path Traversal via Save As Language Code Exploitation status Not known exploited Fix Published 09/04/2026 Severity High CVE-2026-85602Grav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication Bypass Exploitation status Public exploit Fix Published 09/04/2026 Severity Critical CVE-2026-85601Grav Admin before 2.0.20 Cross-Site Scripting via marked.js Exploitation status Not known exploited Fix Published 09/04/2026 Severity Medium CVE-2026-85600Grav Admin before 2.0.21 Stored XSS via username Exploitation status Public exploit Fix Published 09/04/2026 Severity Medium CVE-2026-85599Grav Shortcode Core before 6.2.5 Stored XSS via unescaped parameters Exploitation status Public exploit Fix Published 09/04/2026 Severity Medium CVE-2026-85598Grav 2.0.0 through 2.0.17 Stored XSS via Modular Pages Exploitation status Not known exploited Fix Published 09/04/2026 Severity Medium CVE-2026-80204Grav before 1.0.18 Authentication Bypass via Scoped API Key Exploitation status Not known exploited Fix Published 08/26/2026 Severity Critical CVE-2026-80203Grav before 1.0.18 Authentication Bypass via Scoped API Key Exploitation status Not known exploited Fix Published 08/26/2026 Severity Critical CVE-2026-76846Grav before 2.0.16 Information Disclosure via Twig Sandbox Exploitation status Public exploit Fix Published 08/25/2026 Severity High CVE-2026-76839Grav before 2.0.16 Information Disclosure via offsetGet Exploitation status Public exploit Fix Published 08/25/2026 Severity High CVE-2026-75574Grav before 4.2.2 Remote Code Execution via Email Twig Exploitation status Not known exploited Fix Published 08/25/2026 Severity High CVE-2026-72702Grav CMS before 2.0.16 Origin Validation Bypass via Referer Exploitation status Public exploit Fix Published 08/25/2026 Severity Critical CVE-2026-72701Grav CMS before 2.0.16 Timing Attack via verifyNonce Exploitation status Public exploit Fix Published 08/25/2026 Severity Medium CVE-2026-72700Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparison Exploitation status Public exploit Fix Published 08/25/2026 Severity High CVE-2026-72699Grav Login Plugin before 3.9.1 Email Enumeration via Registration Exploitation status Public exploit Fix Published 08/25/2026 Severity Critical CVE-2026-72698Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass Exploitation status Not known exploited Fix Published 08/25/2026 Severity High CVE-2026-72697Grav CMS before 2.0.16 Path Traversal via media_directory Exploitation status Public exploit Fix Published 08/25/2026 Severity High CVE-2026-72696Grav CMS before 2.0.16 Symlink Following via createLockFile Exploitation status Public exploit Fix Published 08/25/2026 Severity High CVE-2026-72695Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile Exploitation status Public exploit Fix Published 08/25/2026 Severity High CVE-2026-56710Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock Exploitation status Not known exploited Fix Published 08/25/2026 Severity Critical CVE-2026-56709Grav before 3.9.2 Host Header Injection via sendInvitationEmail Exploitation status Not known exploited Fix Published 08/25/2026 Severity High CVE-2026-56708Grav API Plugin before 1.0.16 SSRF via DNS Rebinding Exploitation status Not known exploited Fix Published 08/25/2026 Severity Medium CVE-2026-56707Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcode Exploitation status Not known exploited Fix Published 08/25/2026 Severity High CVE-2026-64850Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData() Exploitation status Public exploit Fix Published 08/19/2026 Severity High CVE-2026-62673Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems Exploitation status Public exploit Fix Published 08/19/2026 Severity High CVE-2026-62672Grav: Authenticated ReDoS via regex_replace in Twig Sandbox Exploitation status Public exploit Fix Published 08/19/2026 Severity Medium CVE-2026-62669Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge Exploitation status Not known exploited Fix Published 08/19/2026 Severity High CVE-2026-62668Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols Exploitation status Public exploit Fix Published 08/19/2026 Severity Critical CVE-2026-61842Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass) Exploitation status Not known exploited Fix Published 08/19/2026 Severity Medium CVE-2026-61690Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits Exploitation status Public exploit Fix Published 08/19/2026 Severity Medium CVE-2026-53654Grav: Unauthenticated open redirect via login twofa_cancel _redirect Exploitation status Public exploit Fix Published 08/19/2026 Severity Medium CVE-2026-75837Grav before 2.0.14 Privilege Escalation via Group Access Field Exploitation status Public exploit Fix Published 08/18/2026 Severity Critical CVE-2026-75836Grav API Plugin before 1.0.14 Missing Authorization Exploitation status Public exploit Fix Published 08/18/2026 Severity High CVE-2026-75835Grav API Plugin before 1.0.14 Missing Authorization Exploitation status Public exploit Fix Published 08/18/2026 Severity Critical CVE-2026-75834Grav before 2.0.14 Stored XSS via Invalid UTF-8 Byte Exploitation status Not known exploited Fix Published 08/18/2026 Severity Medium CVE-2026-75833Grav API Plugin Open Redirect via Backslash Bypass Exploitation status Public exploit Fix Published 08/18/2026 Severity High CVE-2026-75832Grav API Plugin before 1.0.14 Authorization Bypass Exploitation status Not known exploited Fix Published 08/18/2026 Severity Critical CVE-2026-75831Grav before 2.0.15 Stored XSS via audio/video source URL Exploitation status Public exploit Fix Published 08/18/2026 Severity Medium CVE-2026-75830grav-plugin-api before 1.0.15 Path Traversal via batchCopy Exploitation status Public exploit Fix Published 08/18/2026 Severity High CVE-2026-75829grav-plugin-api before 1.0.15 Twig SSTI via translate endpoint Exploitation status Not known exploited Fix Published 08/18/2026 Severity High CVE-2026-75828Grav before 2.0.15 Stored XSS via detectXss() Quote Bypass Exploitation status Public exploit Fix Published 08/18/2026 Severity Critical CVE-2026-75827Grav before 2.0.15 Arbitrary File Write via error_log Exploitation status Public exploit Fix Published 08/18/2026 Severity Critical CVE-2026-75107Grav Form Plugin before 9.1.19 Stored XSS via Field Properties Exploitation status Public exploit Fix Published 08/18/2026 Severity Medium CVE-2026-74908Grav plugin-api before 1.0.15 Script Injection via SVG Exploitation status Not known exploited Fix Published 08/18/2026 Severity Medium CVE-2026-74907Grav before 2.0.15 Path Traversal via plugin-asset-map.php Exploitation status Not known exploited Fix Published 08/18/2026 Severity High CVE-2026-72833Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys Exploitation status Not known exploited Fix Published 08/14/2026 Severity High CVE-2026-72832Grav before 2.0.12 Stored XSS via quoted-attribute bypass Exploitation status Public exploit Fix Published 08/14/2026 Severity Medium CVE-2026-72831Grav through 2.0.11 Authentication Bypass via Flex Objects Exploitation status Public exploit Fix Published 08/14/2026 Severity High CVE-2026-72830Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass Exploitation status Public exploit Fix Published 08/14/2026 Severity High CVE-2026-72829Grav before 1.0.13 API Key Scope Bypass via UsersController Exploitation status Public exploit Fix Published 08/14/2026 Severity High CVE-2026-72828Grav before 1.0.13 API Key Scope Bypass via InvitationsController Exploitation status Not known exploited Fix Published 08/14/2026 Severity High CVE-2026-72827Grav CMS before 2.0.13 Remote Code Execution via Twig Exploitation status Public exploit Fix Published 08/14/2026 Severity High CVE-2026-72826Grav before 1.0.13 Scope Bypass via createApiKey Exploitation status Public exploit Fix Published 08/14/2026 Severity High CVE-2026-72825Grav before 1.0.13 API-key scope cap bypass via ReportsController Exploitation status Public exploit Fix Published 08/14/2026 Severity High CVE-2026-72824Grav before 1.0.13 API Key Scope Bypass via PagesController Exploitation status Public exploit Fix Published 08/14/2026 Severity High CVE-2026-72823Grav before 1.0.13 API-key scope cap bypass via DemoController Exploitation status Not known exploited Fix Published 08/14/2026 Severity Medium CVE-2026-72822Grav before 1.0.13 Authentication Bypass via disable2fa Exploitation status Not known exploited Fix Published 08/14/2026 Severity High CVE-2026-72821Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle Exploitation status Public exploit Fix Published 08/14/2026 Severity Medium CVE-2026-72820Grav 2.0.11 Path Traversal via Backup Profile Configuration Exploitation status Public exploit Fix Published 08/14/2026 Severity Medium CVE-2026-72819Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload Exploitation status Public exploit Fix Published 08/14/2026 Severity High CVE-2026-69089Grav CMS before 2.0.11 Path Traversal via watermark Exploitation status Public exploit Fix Published 08/03/2026 Severity High CVE-2026-69088Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint Exploitation status Public exploit Fix Published 08/03/2026 Severity High CVE-2026-66400Grav Login Plugin before 3.8.13 Insufficient Session Expiration Exploitation status Public exploit Fix Published 07/29/2026 Severity Medium CVE-2026-65897Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups Exploitation status Public exploit Fix Published 07/23/2026 Severity High CVE-2026-65896Grav API Plugin before 1.0.10 Path Traversal via move Exploitation status Public exploit Fix Published 07/23/2026 Severity High CVE-2026-65895Grav API Plugin before 1.0.10 Broken Access Control Exploitation status Public exploit Fix Published 07/23/2026 Severity High CVE-2026-65608Grav before 2.0.9 Remote Code Execution via FlexDirectory Exploitation status Public exploit Fix Published 07/23/2026 Severity High CVE-2026-65603Grav Login Plugin 3.8.11 Privilege Escalation via Profile Update Exploitation status Public exploit Fix Published 07/22/2026 Severity High CVE-2026-65008Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData Exploitation status Public exploit Fix Published 07/21/2026 Severity Critical CVE-2026-65007Grav before 1.0.8 Missing Authorization on API Key Generation Exploitation status Public exploit Fix Published 07/21/2026 Severity High CVE-2026-64628Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers Exploitation status Public exploit Fix Published 07/21/2026 Severity Medium CVE-2026-62387Grav < 1.0.0-rc.16 CORS Misconfiguration via API Plugin Exploitation status Public exploit Fix Published 07/17/2026 Severity High CVE-2026-62386Grav < 1.0.0-rc.16 Authentication Bypass via token URL Parameter Exploitation status Public exploit Fix Published 07/17/2026 Severity High CVE-2026-62237Grav < 2.0.4 ReDoS via regex_replace in Sandbox Exploitation status Public exploit Fix Published 07/17/2026 Severity Medium CVE-2026-62236grav-plugin-login < 3.8.11 CSRF via regenerate2FASecret Exploitation status Public exploit Fix Published 07/17/2026 Severity Low CVE-2026-62235Grav Flex-Objects < 1.4.3 Authorization Bypass via API Exploitation status Not known exploited Fix Published 07/17/2026 Severity Low CVE-2026-62234Grav < 2.0.4 SSRF via Unrestricted cURL Protocols Exploitation status Public exploit Fix Published 07/17/2026 Severity High CVE-2026-62233grav-plugin-api < 1.0.6 Privilege Escalation via createApiKey Exploitation status Not known exploited Fix Published 07/17/2026 Severity High CVE-2026-62232Grav < 2.0.4 2FA Bypass via Secret Regeneration Exploitation status Public exploit Fix Published 07/17/2026 Severity Critical CVE-2026-62231Grav < 1.0.6 API Key Scope Bypass via ApiKeyAuthenticator Exploitation status Public exploit Fix Published 07/17/2026 Severity High CVE-2026-62230Grav < 2.0.4 File Access Bypass via Case Variation Exploitation status Public exploit Fix Published 07/17/2026 Severity High CVE-2026-61873Grav before 9.1.8 Arbitrary File Write via Twig-Processed Filename Exploitation status Public exploit Fix Published 07/15/2026 Severity High CVE-2026-61457Grav before 1.0.3 Remote Code Execution via File Upload Extension Bypass Exploitation status Public exploit Fix Published 07/15/2026 Severity Medium CVE-2026-61453Grav before 2.0.1 XSS via Twig String Concatenation Exploitation status Public exploit Fix Published 07/15/2026 Severity Medium CVE-2026-61452Grav before 2.0.4 Improper Session Invalidation JWT Access Tokens Exploitation status Public exploit Fix Published 07/15/2026 Severity Medium CVE-2026-61451Grav before 1.0.4 Password Reset Token Poisoning via admin_base_url Exploitation status Public exploit Fix Published 07/15/2026 Severity Critical CVE-2026-61449Grav before 2.0.2 Decompression Bomb via Forged ZIP Size Exploitation status Public exploit Fix Published 07/15/2026 Severity High CVE-2026-58655Grav Flex Objects - Server-Side Template Injection via Dynamic Titles Exploitation status Public exploit Fix Published 07/15/2026 Severity High CVE-2026-61454Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__ Exploitation status Public exploit Fix Published 07/11/2026 Severity High CVE-2026-59193Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip() Exploitation status Public exploit Fix Published 07/10/2026 Severity Medium CVE-2026-59190Grav Admin Plugin — IDOR Privilege Escalation via saveUser() Exploitation status Public exploit Fix Published 07/10/2026 Severity High CVE-2026-58493grav-plugin-database: DSN Parameter Injection via Unsanitized Configuration Values in Connection String Construction Exploitation status Public exploit Fix Published 07/10/2026 Severity Medium CVE-2026-58492grav-plugin-database: SQL Injection in PDO::tableExists() due to Unsanitized Table Name Interpolation Exploitation status Public exploit Fix Published 07/10/2026 Severity Critical CVE-2026-55890Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() Exploitation status Public exploit Fix Published 07/10/2026 Severity Medium CVE-2026-55885Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets Exploitation status Public exploit Fix Published 07/10/2026 Severity Medium 
