Known Vulnerabilities for Grav Cms by Getgrav
Listed below are 5 of the newest known vulnerabilities associated with "Grav Cms" by "Getgrav".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-124434 json | Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x calls any medium method named in image, thumb or thumb_options sh... | Not Provided | 2026-11-08 | 2026-11-08 |
| CVE-2026-117604 json | Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows un... | Not Provided | 2026-10-27 | 2026-11-02 |
| CVE-2026-116019 json | Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public stat... | Not Provided | 2026-10-24 | 2026-10-26 |
| CVE-2026-114660 json | Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allo... | Not Provided | 2026-10-22 | 2026-11-05 |
| CVE-2026-114659 json | Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages ... | Not Provided | 2026-10-22 | 2026-10-23 |
| CVE-2026-114658 json | Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allow... | Not Provided | 2026-10-22 | 2026-10-28 |
| CVE-2026-114657 json | Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' H... | Not Provided | 2026-10-22 | 2026-10-28 |
| CVE-2026-112782 json | Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous vi... | Not Provided | 2026-10-19 | 2026-10-20 |
| CVE-2026-112781 json | Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected conf... | Not Provided | 2026-10-19 | 2026-10-20 |
| CVE-2026-112780 json | Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public st... | Not Provided | 2026-10-19 | 2026-10-22 |
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Getgrav | Grav Cms | 1.7.7 | |||
| Application | Getgrav | Grav Cms | 1.7.6 | |||
| Application | Getgrav | Grav Cms | 1.7.5 | |||
| Application | Getgrav | Grav Cms | 1.7.4 | |||
| Application | Getgrav | Grav Cms | 1.7.3 | |||
| Application | Getgrav | Grav Cms | 1.7.1 | |||
| Application | Getgrav | Grav Cms | 1.7.0 | |||
| Application | Getgrav | Grav Cms | 1.7.0 | |||
| Application | Getgrav | Grav Cms | 1.7.0 | |||
| Application | Getgrav | Grav Cms | 1.7.0 | |||
| Application | Getgrav | Grav Cms | 1.7.0 | |||
| Application | Getgrav | Grav Cms | 1.7.0 | |||
| Application | Getgrav | Grav Cms | 1.7.0 | |||
| Application | Getgrav | Grav Cms | 1.7.0 | |||
| Application | Getgrav | Grav Cms | 1.7.0 | |||
| Application | Getgrav | Grav Cms | 1.7.0 | |||
| Application | Getgrav | Grav Cms | 1.7.0 | |||
| Application | Getgrav | Grav Cms | 1.7.0 | |||
| Application | Getgrav | Grav Cms | 1.7.0 | |||
| Application | Getgrav | Grav Cms | 1.7.0 |