# grav.

Every CVE that names grav among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback](https://agentprime.io/advisories/CVE-2026-117604.md)
  `CVE-2026-117604` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Information disclosure
- [Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives](https://agentprime.io/advisories/CVE-2026-116019.md)
  `CVE-2026-116019` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 24 Oct 2026 · Tags: CWE-749
- [Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives](https://agentprime.io/advisories/CVE-2026-114660.md)
  `CVE-2026-114660` · CVE record: getgrav grav · CVSS 7.0 High · Not analysed yet · Published 22 Oct 2026 · Tags: Code injection
- [Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri](https://agentprime.io/advisories/CVE-2026-114657.md)
  `CVE-2026-114657` · CVE record: getgrav grav · CVSS 6.9 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Information disclosure
- [Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service](https://agentprime.io/advisories/CVE-2026-112782.md)
  `CVE-2026-112782` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 19 Oct 2026 · Tags: Denial of service
- [Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-\*@ Directives](https://agentprime.io/advisories/CVE-2026-112781.md)
  `CVE-2026-112781` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure
- [Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@](https://agentprime.io/advisories/CVE-2026-112780.md)
  `CVE-2026-112780` · CVE record: getgrav grav · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-749
- [Grav before 2.1.7 Information Disclosure via Nested .git Directories](https://agentprime.io/advisories/CVE-2026-109326.md)
  `CVE-2026-109326` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-527
- [Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy](https://agentprime.io/advisories/CVE-2026-109325.md)
  `CVE-2026-109325` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Information disclosure
- [Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms](https://agentprime.io/advisories/CVE-2026-109324.md)
  `CVE-2026-109324` · CVE record: getgrav grav · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-409
- [Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox](https://agentprime.io/advisories/CVE-2026-109315.md)
  `CVE-2026-109315` · CVE record: getgrav grav · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Information disclosure
- [Grav before 2.0.25 Session Cookie Theft via Twig Sandbox](https://agentprime.io/advisories/CVE-2026-100671.md)
  `CVE-2026-100671` · CVE record: getgrav grav · CVSS 8.6 High · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass](https://agentprime.io/advisories/CVE-2026-100670.md)
  `CVE-2026-100670` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypass](https://agentprime.io/advisories/CVE-2026-100669.md)
  `CVE-2026-100669` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: CWE-178
- [Grav before 2.0.25 Sandbox Escape via array Filter](https://agentprime.io/advisories/CVE-2026-100668.md)
  `CVE-2026-100668` · CVE record: getgrav grav · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass](https://agentprime.io/advisories/CVE-2026-100667.md)
  `CVE-2026-100667` · CVE record: getgrav grav · CVSS 6.9 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Authentication bypass
- [Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r](https://agentprime.io/advisories/CVE-2026-92917.md)
  `CVE-2026-92917` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure
- [Grav through 2.0.21 Unauthenticated Information Disclosure via Clockwork](https://agentprime.io/advisories/CVE-2026-92916.md)
  `CVE-2026-92916` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure
- [Cross-site scripting in Grav](https://agentprime.io/advisories/CVE-2025-64059.md)
  `CVE-2025-64059` · CVE record: getgrav Grav · CVSS 1.8 Low · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Grav before 2.0.18 Remote Code Execution via sort filter](https://agentprime.io/advisories/CVE-2026-85604.md)
  `CVE-2026-85604` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 4 Sept 2026 · Tags: Code injection
- [Grav Admin Plugin Path Traversal via Save As Language Code](https://agentprime.io/advisories/CVE-2026-85603.md)
  `CVE-2026-85603` · CVE record: getgrav grav · CVSS 7.1 High · Not analysed yet · Published 4 Sept 2026 · Tags: Path traversal
- [Grav Admin before 2.0.20 Cross-Site Scripting via marked.js](https://agentprime.io/advisories/CVE-2026-85601.md)
  `CVE-2026-85601` · CVE record: getgrav grav · CVSS 5.1 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Grav 2.0.0 through 2.0.17 Stored XSS via Modular Pages](https://agentprime.io/advisories/CVE-2026-85598.md)
  `CVE-2026-85598` · CVE record: getgrav grav · CVSS 5.1 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Grav before 1.0.18 Authentication Bypass via Scoped API Key](https://agentprime.io/advisories/CVE-2026-80204.md)
  `CVE-2026-80204` · CVE record: getgrav grav · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Broken access control
- [Grav before 1.0.18 Authentication Bypass via Scoped API Key](https://agentprime.io/advisories/CVE-2026-80203.md)
  `CVE-2026-80203` · CVE record: getgrav grav · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Broken access control
- [Grav before 4.2.2 Remote Code Execution via Email Twig](https://agentprime.io/advisories/CVE-2026-75574.md)
  `CVE-2026-75574` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 25 Aug 2026 · Tags: Code injection
- [Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparison](https://agentprime.io/advisories/CVE-2026-72700.md)
  `CVE-2026-72700` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-208
- [Grav CMS before 2.0.16 Symlink Following via createLockFile](https://agentprime.io/advisories/CVE-2026-72696.md)
  `CVE-2026-72696` · CVE record: getgrav grav · CVSS 8.6 High · Not analysed yet · Published 25 Aug 2026 · Tags: Path traversal
- [Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock](https://agentprime.io/advisories/CVE-2026-56710.md)
  `CVE-2026-56710` · CVE record: getgrav grav · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Broken access control
- [Grav before 3.9.2 Host Header Injection via sendInvitationEmail](https://agentprime.io/advisories/CVE-2026-56709.md)
  `CVE-2026-56709` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-350
- [Grav API Plugin before 1.0.16 SSRF via DNS Rebinding](https://agentprime.io/advisories/CVE-2026-56708.md)
  `CVE-2026-56708` · CVE record: getgrav grav · CVSS 6.9 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Race condition
- [Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcode](https://agentprime.io/advisories/CVE-2026-56707.md)
  `CVE-2026-56707` · CVE record: getgrav grav · CVSS 8.3 High · Not analysed yet · Published 25 Aug 2026 · Tags: Broken access control
- [Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols](https://agentprime.io/advisories/CVE-2026-62668.md)
  `CVE-2026-62668` · CVE record: getgrav grav and 1 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Grav: Unauthenticated open redirect via login twofa_cancel \_redirect](https://agentprime.io/advisories/CVE-2026-53654.md)
  `CVE-2026-53654` · CVE record: getgrav grav · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Open redirect
- [Grav API Plugin before 1.0.14 Missing Authorization](https://agentprime.io/advisories/CVE-2026-75836.md)
  `CVE-2026-75836` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 18 Aug 2026 · Tags: Broken access control
- [Grav API Plugin before 1.0.14 Missing Authorization](https://agentprime.io/advisories/CVE-2026-75835.md)
  `CVE-2026-75835` · CVE record: getgrav grav · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Broken access control
- [Grav API Plugin Open Redirect via Backslash Bypass](https://agentprime.io/advisories/CVE-2026-75833.md)
  `CVE-2026-75833` · CVE record: getgrav grav · CVSS 8.6 High · Not analysed yet · Published 18 Aug 2026 · Tags: Open redirect
- [Grav API Plugin before 1.0.14 Authorization Bypass](https://agentprime.io/advisories/CVE-2026-75832.md)
  `CVE-2026-75832` · CVE record: getgrav grav · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Broken access control
- [grav-plugin-api before 1.0.15 Path Traversal via batchCopy](https://agentprime.io/advisories/CVE-2026-75830.md)
  `CVE-2026-75830` · CVE record: getgrav grav · CVSS 7.1 High · Not analysed yet · Published 18 Aug 2026 · Tags: Path traversal
- [grav-plugin-api before 1.0.15 Twig SSTI via translate endpoint](https://agentprime.io/advisories/CVE-2026-75829.md)
  `CVE-2026-75829` · CVE record: getgrav grav · CVSS 8.6 High · Not analysed yet · Published 18 Aug 2026 · Tags: Code injection
- [Grav Form Plugin before 9.1.19 Stored XSS via Field Properties](https://agentprime.io/advisories/CVE-2026-75107.md)
  `CVE-2026-75107` · CVE record: getgrav grav · CVSS 5.1 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Cross-site scripting (XSS)
- [Grav plugin-api before 1.0.15 Script Injection via SVG](https://agentprime.io/advisories/CVE-2026-74908.md)
  `CVE-2026-74908` · CVE record: getgrav grav · CVSS 5.1 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Cross-site scripting (XSS)
- [Grav through 2.0.11 Authentication Bypass via Flex Objects](https://agentprime.io/advisories/CVE-2026-72831.md)
  `CVE-2026-72831` · CVE record: getgrav grav and 1 more · CVSS 8.7 High · Not analysed yet · Published 14 Aug 2026 · Tags: Broken access control
- [Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass](https://agentprime.io/advisories/CVE-2026-72830.md)
  `CVE-2026-72830` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 14 Aug 2026 · Tags: Privilege escalation
- [Grav before 1.0.13 API Key Scope Bypass via UsersController](https://agentprime.io/advisories/CVE-2026-72829.md)
  `CVE-2026-72829` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 14 Aug 2026 · Tags: Privilege escalation
- [Grav before 1.0.13 API Key Scope Bypass via InvitationsController](https://agentprime.io/advisories/CVE-2026-72828.md)
  `CVE-2026-72828` · CVE record: getgrav grav · CVSS 8.6 High · Not analysed yet · Published 14 Aug 2026 · Tags: Privilege escalation
- [Grav CMS before 2.0.13 Remote Code Execution via Twig](https://agentprime.io/advisories/CVE-2026-72827.md)
  `CVE-2026-72827` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 14 Aug 2026 · Tags: Code injection
- [Grav before 1.0.13 API Key Scope Bypass via PagesController](https://agentprime.io/advisories/CVE-2026-72824.md)
  `CVE-2026-72824` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 14 Aug 2026 · Tags: Broken access control
- [Grav before 1.0.13 API-key scope cap bypass via DemoController](https://agentprime.io/advisories/CVE-2026-72823.md)
  `CVE-2026-72823` · CVE record: getgrav grav · CVSS 5.3 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: Broken access control
- [Grav before 1.0.13 Authentication Bypass via disable2fa](https://agentprime.io/advisories/CVE-2026-72822.md)
  `CVE-2026-72822` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 14 Aug 2026 · Tags: Authentication bypass
- [Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle](https://agentprime.io/advisories/CVE-2026-72821.md)
  `CVE-2026-72821` · CVE record: getgrav grav · CVSS 5.1 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: Cross-site scripting (XSS)
- [Grav 2.0.11 Path Traversal via Backup Profile Configuration](https://agentprime.io/advisories/CVE-2026-72820.md)
  `CVE-2026-72820` · CVE record: getgrav grav · CVSS 6.9 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: Path traversal
- [Grav Login Plugin before 3.8.13 Insufficient Session Expiration](https://agentprime.io/advisories/CVE-2026-66400.md)
  `CVE-2026-66400` · CVE record: getgrav grav · CVSS 6.3 Medium · Not analysed yet · Published 29 Jul 2026 · Tags: Authentication bypass
- [Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups](https://agentprime.io/advisories/CVE-2026-65897.md)
  `CVE-2026-65897` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 23 Jul 2026 · Tags: Privilege escalation
- [Grav API Plugin before 1.0.10 Path Traversal via move](https://agentprime.io/advisories/CVE-2026-65896.md)
  `CVE-2026-65896` · CVE record: getgrav grav · CVSS 7.1 High · Not analysed yet · Published 23 Jul 2026 · Tags: Path traversal
- [Grav API Plugin before 1.0.10 Broken Access Control](https://agentprime.io/advisories/CVE-2026-65895.md)
  `CVE-2026-65895` · CVE record: getgrav grav · CVSS 8.2 High · Not analysed yet · Published 23 Jul 2026 · Tags: Broken access control
- [Grav Login Plugin 3.8.11 Privilege Escalation via Profile Update](https://agentprime.io/advisories/CVE-2026-65603.md)
  `CVE-2026-65603` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 22 Jul 2026 · Tags: Privilege escalation
- [Grav before 1.0.8 Missing Authorization on API Key Generation](https://agentprime.io/advisories/CVE-2026-65007.md)
  `CVE-2026-65007` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control
- [Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers](https://agentprime.io/advisories/CVE-2026-64628.md)
  `CVE-2026-64628` · CVE record: getgrav grav · CVSS 5.1 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Cross-site scripting (XSS)
- [Grav < 1.0.0-rc.16 CORS Misconfiguration via API Plugin](https://agentprime.io/advisories/CVE-2026-62387.md)
  `CVE-2026-62387` · CVE record: getgrav grav · CVSS 7.1 High · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-942

Older: <https://agentprime.io/advisories/technology/grav.md?cursor=WyIyMDI2LTA3LTE3VDAwOjA3OjE0LjQyNjAwMFoiLCJDVkUtMjAyNi02MjM4NyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=grav>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/grav/>. Everything for agents: <https://agentprime.io/llms.txt>.