getgrav vulnerabilities

CVEs per yearBy the year they were published

1. 20218
2. 20225
3. 20236
4. 20247
5. 202519
6. 2026167

Newest CVEs

• CVE-2026-124434

  Grav Lightbox Gallery 1.1.0 before 1.3.2 File Read via Shortcode Media Actions

  getgrav · grav

  High7.1
• CVE-2026-117604

  Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback

  getgrav · grav

  High8.7
• CVE-2026-116019

  Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives

  getgrav · grav

  High8.7
• CVE-2026-114660

  Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives

  getgrav · grav

  High7.0
• CVE-2026-114659

  Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes

  getgrav · grav-plugin-flex-objects

  High7.1
• CVE-2026-114658

  Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite

  getgrav · grav-plugin-login

  High8.7
• CVE-2026-114657

  Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri

  getgrav · grav

  Medium6.9
• CVE-2026-112782

  Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service

  getgrav · grav

  High8.7
• CVE-2026-112781

  Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives

  getgrav · grav

  High8.7
• CVE-2026-112780

  Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@

  getgrav · grav

  Critical9.3