Known Vulnerabilities for Grav-plugin-api by Getgrav
Listed below are 1 of the newest known vulnerabilities associated with "Grav-plugin-api" by "Getgrav".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-61456 json | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 fails to sanitize SVG files uploaded through the POST /api/v1/medi... | Not Provided | 2026-07-10 | 2026-07-10 |
| CVE-2026-61454 json | The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable window.__GRAV_CONFIG__ i... | Not Provided | 2026-07-11 | 2026-07-11 |
| CVE-2026-61450 json | Grav before 2.0.2 contains a Twig sandbox bypass that allows a page author (any admin.pages user, or anyone able to write to ... | Not Provided | 2026-07-10 | 2026-07-10 |
| CVE-2026-59190 json | grav-plugin-admin is an HTML user interface that provides a way to configure Grav and create and modify pages. In 1.10.52 and... | Not Provided | 2026-07-10 | 2026-07-10 |
| CVE-2026-58656 json | Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-A... | Not Provided | 2026-07-08 | 2026-07-08 |
| CVE-2026-58654 json | The Grav API plugin (getgrav/grav-plugin-api) 1.0.0 contains an unrestricted file upload vulnerability in the avatar upload e... | Not Provided | 2026-07-08 | 2026-07-08 |
| CVE-2026-58493 json | grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, Database::__call builds PDO DSN strings by directly... | Not Provided | 2026-07-10 | 2026-07-10 |
| CVE-2026-58492 json | grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PDO::tableExists method interpolates its table ... | Not Provided | 2026-07-10 | 2026-07-10 |
| CVE-2026-56700 json | Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls - in Schedule... | Not Provided | 2026-06-30 | 2026-07-01 |
| CVE-2026-44738 json | Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any user with the admin.pages rol... | Not Provided | 2026-05-11 | 2026-05-14 |