Known Vulnerabilities for Grav Cms by Getgrav
Listed below are 5 of the newest known vulnerabilities associated with "Grav Cms" by "Getgrav".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-100673 json | The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 render stored data entries in the... | Not Provided | 2026-09-26 | 2026-09-30 |
| CVE-2026-100672 json | The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version 1.2.10 registers an admin handler that return... | Not Provided | 2026-09-26 | 2026-09-28 |
| CVE-2026-100671 json | Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig ... | Not Provided | 2026-09-26 | 2026-09-28 |
| CVE-2026-100670 json | Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access ... | Not Provided | 2026-09-26 | 2026-09-30 |
| CVE-2026-100669 json | Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively. In we... | Not Provided | 2026-09-26 | 2026-09-30 |
| CVE-2026-100668 json | Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The `array` filter (and its identical function form) is on t... | Not Provided | 2026-09-26 | 2026-09-28 |
| CVE-2026-100667 json | grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challenge to ... | Not Provided | 2026-09-26 | 2026-09-28 |
| CVE-2026-92917 json | Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and seria... | Not Provided | 2026-09-17 | 2026-09-19 |
| CVE-2026-92916 json | Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled (system.debugg... | Not Provided | 2026-09-17 | 2026-09-30 |
| CVE-2026-86197 json | Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss ... | Not Provided | 2026-09-05 | 2026-09-10 |
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Getgrav | Grav Cms | 1.7.7 | |||
| Application | Getgrav | Grav Cms | 1.7.6 | |||
| Application | Getgrav | Grav Cms | 1.7.5 | |||
| Application | Getgrav | Grav Cms | 1.7.4 | |||
| Application | Getgrav | Grav Cms | 1.7.3 | |||
| Application | Getgrav | Grav Cms | 1.7.1 | |||
| Application | Getgrav | Grav Cms | 1.7.0 | |||
| Application | Getgrav | Grav Cms | 1.7.0 | |||
| Application | Getgrav | Grav Cms | 1.7.0 | |||
| Application | Getgrav | Grav Cms | 1.7.0 | |||
| Application | Getgrav | Grav Cms | 1.7.0 | |||
| Application | Getgrav | Grav Cms | 1.7.0 | |||
| Application | Getgrav | Grav Cms | 1.7.0 | |||
| Application | Getgrav | Grav Cms | 1.7.0 | |||
| Application | Getgrav | Grav Cms | 1.7.0 | |||
| Application | Getgrav | Grav Cms | 1.7.0 | |||
| Application | Getgrav | Grav Cms | 1.7.0 | |||
| Application | Getgrav | Grav Cms | 1.7.0 | |||
| Application | Getgrav | Grav Cms | 1.7.0 | |||
| Application | Getgrav | Grav Cms | 1.7.0 |