agentprime: getgrav-grav-plugin-api

agentprime: getgrav-grav-plugin-apiEvery new CVE for getgrav-grav-plugin-api.https://agentprime.io/CVE-2026-112779: Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypasshttps://agentprime.io/advisories/CVE-2026-112779/https://agentprime.io/advisories/CVE-2026-112779/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 19:10:55 GMTCVEcriticalCVE-2026-109320: Grav API Plugin before 1.0.36 Disabled Account Session Access Bypasshttps://agentprime.io/advisories/CVE-2026-109320/https://agentprime.io/advisories/CVE-2026-109320/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:05:12 GMTCVECVE-2026-109317: Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grantshttps://agentprime.io/advisories/CVE-2026-109317/https://agentprime.io/advisories/CVE-2026-109317/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:05:10 GMTCVECVE-2026-86196: Grav API Plugin before 1.0.20 Authentication Bypass via Host Headerhttps://agentprime.io/advisories/CVE-2026-86196/https://agentprime.io/advisories/CVE-2026-86196/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 05 Sep 2026 12:09:09 GMTCVECVE-2026-86195: grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flaghttps://agentprime.io/advisories/CVE-2026-86195/https://agentprime.io/advisories/CVE-2026-86195/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 05 Sep 2026 12:09:08 GMTCVECVE-2026-86193: Grav API Plugin Authentication Bypass via Group-Inherited Superhttps://agentprime.io/advisories/CVE-2026-86193/https://agentprime.io/advisories/CVE-2026-86193/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 05 Sep 2026 12:09:07 GMTCVECVE-2026-64852: Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any accounthttps://agentprime.io/advisories/CVE-2026-64852/https://agentprime.io/advisories/CVE-2026-64852/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 16:00:06 GMTCVECVE-2026-63408: Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameterhttps://agentprime.io/advisories/CVE-2026-63408/https://agentprime.io/advisories/CVE-2026-63408/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 15:53:08 GMTCVECVE-2026-63407: Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responseshttps://agentprime.io/advisories/CVE-2026-63407/https://agentprime.io/advisories/CVE-2026-63407/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 15:51:36 GMTCVECVE-2026-62667: Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACLhttps://agentprime.io/advisories/CVE-2026-62667/https://agentprime.io/advisories/CVE-2026-62667/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 15:43:19 GMTCVECVE-2026-62666: Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of superhttps://agentprime.io/advisories/CVE-2026-62666/https://agentprime.io/advisories/CVE-2026-62666/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 15:36:37 GMTCVECVE-2026-62668: Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocolshttps://agentprime.io/advisories/CVE-2026-62668/https://agentprime.io/advisories/CVE-2026-62668/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 15:29:24 GMTCVEcriticalCVE-2026-61607: Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizerhttps://agentprime.io/advisories/CVE-2026-61607/https://agentprime.io/advisories/CVE-2026-61607/CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 15:18:15 GMTCVECVE-2026-72833: Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keyshttps://agentprime.io/advisories/CVE-2026-72833/https://agentprime.io/advisories/CVE-2026-72833/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 14 Aug 2026 11:35:39 GMTCVECVE-2026-72826: Grav API Plugin before 1.0.13 Scope Bypass via createApiKeyhttps://agentprime.io/advisories/CVE-2026-72826/https://agentprime.io/advisories/CVE-2026-72826/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 14 Aug 2026 11:35:34 GMTCVECVE-2026-72825: Grav API Plugin before 1.0.13 API-key scope cap bypass via ReportsControllerhttps://agentprime.io/advisories/CVE-2026-72825/https://agentprime.io/advisories/CVE-2026-72825/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 14 Aug 2026 11:35:33 GMTCVECVE-2026-61451: Grav API Plugin before 1.0.4 Password Reset Token Poisoning via admin_base_urlhttps://agentprime.io/advisories/CVE-2026-61451/https://agentprime.io/advisories/CVE-2026-61451/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Jul 2026 11:25:44 GMTCVEcritical