getgrav grav-plugin-api vulnerabilities
18 published CVEs name getgrav grav-plugin-api among the affected products.
- 18Published CVEs18 of them scored
- 18Last 12 monthspublished in the last year
- 3Critical13 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-112779
Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass
getgrav · grav-plugin-api
Critical9.3 - CVE-2026-109320
Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass
getgrav · grav-plugin-api
Medium5.3 - CVE-2026-109317
Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants
getgrav · grav-plugin-api
High8.6 - CVE-2026-86196
Grav API Plugin before 1.0.20 Authentication Bypass via Host Header
getgrav · grav-plugin-api
High8.7 - CVE-2026-86195
grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag
getgrav · grav-plugin-api
High8.7 - CVE-2026-86193
Grav API Plugin Authentication Bypass via Group-Inherited Super
getgrav · grav-plugin-api
High8.7 - CVE-2026-64852
Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account
getgrav · grav-plugin-api
High8.7 - CVE-2026-63408
Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter
getgrav · grav-plugin-api
High7.5 - CVE-2026-63407
Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responses
getgrav · grav-plugin-api
High8.2 - CVE-2026-62667
Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL
getgrav · grav-plugin-api
High8.1