agentprime: gravEvery new CVE for grav.https://agentprime.io/CVE-2026-117604: Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallbackhttps://agentprime.io/advisories/CVE-2026-117604/https://agentprime.io/advisories/CVE-2026-117604/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 14:39:10 GMTCVECVE-2026-116019: Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directiveshttps://agentprime.io/advisories/CVE-2026-116019/https://agentprime.io/advisories/CVE-2026-116019/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 24 Oct 2026 11:40:35 GMTCVECVE-2026-114660: Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directiveshttps://agentprime.io/advisories/CVE-2026-114660/https://agentprime.io/advisories/CVE-2026-114660/CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 22 Oct 2026 01:43:44 GMTCVECVE-2026-114657: Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Urihttps://agentprime.io/advisories/CVE-2026-114657/https://agentprime.io/advisories/CVE-2026-114657/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 22 Oct 2026 01:43:42 GMTCVECVE-2026-112782: Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Servicehttps://agentprime.io/advisories/CVE-2026-112782/https://agentprime.io/advisories/CVE-2026-112782/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 19:10:58 GMTCVECVE-2026-112781: Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directiveshttps://agentprime.io/advisories/CVE-2026-112781/https://agentprime.io/advisories/CVE-2026-112781/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 19:10:57 GMTCVECVE-2026-112780: Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@https://agentprime.io/advisories/CVE-2026-112780/https://agentprime.io/advisories/CVE-2026-112780/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 19:10:56 GMTCVEcriticalCVE-2026-109326: Grav before 2.1.7 Information Disclosure via Nested .git Directorieshttps://agentprime.io/advisories/CVE-2026-109326/https://agentprime.io/advisories/CVE-2026-109326/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:05:17 GMTCVECVE-2026-109325: Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxyhttps://agentprime.io/advisories/CVE-2026-109325/https://agentprime.io/advisories/CVE-2026-109325/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:05:16 GMTCVECVE-2026-109324: Grav before 2.1.7 Memory Exhaustion via Oversized Image Transformshttps://agentprime.io/advisories/CVE-2026-109324/https://agentprime.io/advisories/CVE-2026-109324/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:05:15 GMTCVECVE-2026-109315: Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandboxhttps://agentprime.io/advisories/CVE-2026-109315/https://agentprime.io/advisories/CVE-2026-109315/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:05:09 GMTCVECVE-2026-100671: Grav before 2.0.25 Session Cookie Theft via Twig Sandboxhttps://agentprime.io/advisories/CVE-2026-100671/https://agentprime.io/advisories/CVE-2026-100671/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 26 Sep 2026 13:23:35 GMTCVECVE-2026-100670: Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypasshttps://agentprime.io/advisories/CVE-2026-100670/https://agentprime.io/advisories/CVE-2026-100670/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 26 Sep 2026 13:23:34 GMTCVECVE-2026-100669: Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypasshttps://agentprime.io/advisories/CVE-2026-100669/https://agentprime.io/advisories/CVE-2026-100669/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 26 Sep 2026 13:23:34 GMTCVECVE-2026-100668: Grav before 2.0.25 Sandbox Escape via array Filterhttps://agentprime.io/advisories/CVE-2026-100668/https://agentprime.io/advisories/CVE-2026-100668/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 26 Sep 2026 13:23:33 GMTCVECVE-2026-100667: grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypasshttps://agentprime.io/advisories/CVE-2026-100667/https://agentprime.io/advisories/CVE-2026-100667/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 26 Sep 2026 13:23:32 GMTCVECVE-2026-92917: Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_rhttps://agentprime.io/advisories/CVE-2026-92917/https://agentprime.io/advisories/CVE-2026-92917/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 17 Sep 2026 11:16:45 GMTCVECVE-2026-92916: Grav through 2.0.21 Unauthenticated Information Disclosure via Clockworkhttps://agentprime.io/advisories/CVE-2026-92916/https://agentprime.io/advisories/CVE-2026-92916/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 17 Sep 2026 11:16:44 GMTCVECVE-2025-64059: Cross-site scripting in Gravhttps://agentprime.io/advisories/CVE-2025-64059/https://agentprime.io/advisories/CVE-2025-64059/CVSS 1.8 (Low). Published by the CVE Program. Not analysed by agentprime yet.Sun, 13 Sep 2026 00:00:00 GMTCVECVE-2026-85604: Grav before 2.0.18 Remote Code Execution via sort filterhttps://agentprime.io/advisories/CVE-2026-85604/https://agentprime.io/advisories/CVE-2026-85604/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 04 Sep 2026 11:30:05 GMTCVECVE-2026-85603: Grav Admin Plugin Path Traversal via Save As Language Codehttps://agentprime.io/advisories/CVE-2026-85603/https://agentprime.io/advisories/CVE-2026-85603/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 04 Sep 2026 11:30:04 GMTCVECVE-2026-85601: Grav Admin before 2.0.20 Cross-Site Scripting via marked.jshttps://agentprime.io/advisories/CVE-2026-85601/https://agentprime.io/advisories/CVE-2026-85601/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 04 Sep 2026 11:30:03 GMTCVECVE-2026-85598: Grav 2.0.0 through 2.0.17 Stored XSS via Modular Pageshttps://agentprime.io/advisories/CVE-2026-85598/https://agentprime.io/advisories/CVE-2026-85598/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 04 Sep 2026 11:30:01 GMTCVECVE-2026-80204: Grav before 1.0.18 Authentication Bypass via Scoped API Keyhttps://agentprime.io/advisories/CVE-2026-80204/https://agentprime.io/advisories/CVE-2026-80204/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 26 Aug 2026 10:28:13 GMTCVEcriticalCVE-2026-80203: Grav before 1.0.18 Authentication Bypass via Scoped API Keyhttps://agentprime.io/advisories/CVE-2026-80203/https://agentprime.io/advisories/CVE-2026-80203/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 26 Aug 2026 10:28:12 GMTCVEcriticalCVE-2026-75574: Grav before 4.2.2 Remote Code Execution via Email Twighttps://agentprime.io/advisories/CVE-2026-75574/https://agentprime.io/advisories/CVE-2026-75574/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 25 Aug 2026 01:30:26 GMTCVECVE-2026-72700: Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparisonhttps://agentprime.io/advisories/CVE-2026-72700/https://agentprime.io/advisories/CVE-2026-72700/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 25 Aug 2026 01:30:22 GMTCVECVE-2026-72696: Grav CMS before 2.0.16 Symlink Following via createLockFilehttps://agentprime.io/advisories/CVE-2026-72696/https://agentprime.io/advisories/CVE-2026-72696/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 25 Aug 2026 01:30:14 GMTCVECVE-2026-56710: Grav Login Plugin before 1.0.16 Privilege Escalation via Unlockhttps://agentprime.io/advisories/CVE-2026-56710/https://agentprime.io/advisories/CVE-2026-56710/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 25 Aug 2026 01:30:11 GMTCVEcriticalCVE-2026-56709: Grav before 3.9.2 Host Header Injection via sendInvitationEmailhttps://agentprime.io/advisories/CVE-2026-56709/https://agentprime.io/advisories/CVE-2026-56709/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 25 Aug 2026 01:30:10 GMTCVECVE-2026-56708: Grav API Plugin before 1.0.16 SSRF via DNS Rebindinghttps://agentprime.io/advisories/CVE-2026-56708/https://agentprime.io/advisories/CVE-2026-56708/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 25 Aug 2026 01:30:08 GMTCVECVE-2026-56707: Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcodehttps://agentprime.io/advisories/CVE-2026-56707/https://agentprime.io/advisories/CVE-2026-56707/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 25 Aug 2026 01:30:06 GMTCVECVE-2026-62668: Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocolshttps://agentprime.io/advisories/CVE-2026-62668/https://agentprime.io/advisories/CVE-2026-62668/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 15:29:24 GMTCVEcriticalCVE-2026-53654: Grav: Unauthenticated open redirect via login twofa_cancel _redirecthttps://agentprime.io/advisories/CVE-2026-53654/https://agentprime.io/advisories/CVE-2026-53654/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 15:15:30 GMTCVECVE-2026-75836: Grav API Plugin before 1.0.14 Missing Authorizationhttps://agentprime.io/advisories/CVE-2026-75836/https://agentprime.io/advisories/CVE-2026-75836/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 11:19:46 GMTCVECVE-2026-75835: Grav API Plugin before 1.0.14 Missing Authorizationhttps://agentprime.io/advisories/CVE-2026-75835/https://agentprime.io/advisories/CVE-2026-75835/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 11:19:45 GMTCVEcriticalCVE-2026-75833: Grav API Plugin Open Redirect via Backslash Bypasshttps://agentprime.io/advisories/CVE-2026-75833/https://agentprime.io/advisories/CVE-2026-75833/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 11:19:44 GMTCVECVE-2026-75832: Grav API Plugin before 1.0.14 Authorization Bypasshttps://agentprime.io/advisories/CVE-2026-75832/https://agentprime.io/advisories/CVE-2026-75832/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 11:19:43 GMTCVEcriticalCVE-2026-75830: grav-plugin-api before 1.0.15 Path Traversal via batchCopyhttps://agentprime.io/advisories/CVE-2026-75830/https://agentprime.io/advisories/CVE-2026-75830/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 11:19:42 GMTCVECVE-2026-75829: grav-plugin-api before 1.0.15 Twig SSTI via translate endpointhttps://agentprime.io/advisories/CVE-2026-75829/https://agentprime.io/advisories/CVE-2026-75829/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 11:19:41 GMTCVECVE-2026-75107: Grav Form Plugin before 9.1.19 Stored XSS via Field Propertieshttps://agentprime.io/advisories/CVE-2026-75107/https://agentprime.io/advisories/CVE-2026-75107/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 11:19:39 GMTCVECVE-2026-74908: Grav plugin-api before 1.0.15 Script Injection via SVGhttps://agentprime.io/advisories/CVE-2026-74908/https://agentprime.io/advisories/CVE-2026-74908/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 11:19:38 GMTCVECVE-2026-72831: Grav through 2.0.11 Authentication Bypass via Flex Objectshttps://agentprime.io/advisories/CVE-2026-72831/https://agentprime.io/advisories/CVE-2026-72831/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 14 Aug 2026 11:35:37 GMTCVECVE-2026-72830: Grav API Plugin before 1.0.13 RCE via ConfigController scope bypasshttps://agentprime.io/advisories/CVE-2026-72830/https://agentprime.io/advisories/CVE-2026-72830/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 14 Aug 2026 11:35:37 GMTCVECVE-2026-72829: Grav before 1.0.13 API Key Scope Bypass via UsersControllerhttps://agentprime.io/advisories/CVE-2026-72829/https://agentprime.io/advisories/CVE-2026-72829/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 14 Aug 2026 11:35:36 GMTCVECVE-2026-72828: Grav before 1.0.13 API Key Scope Bypass via InvitationsControllerhttps://agentprime.io/advisories/CVE-2026-72828/https://agentprime.io/advisories/CVE-2026-72828/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 14 Aug 2026 11:35:35 GMTCVECVE-2026-72827: Grav CMS before 2.0.13 Remote Code Execution via Twighttps://agentprime.io/advisories/CVE-2026-72827/https://agentprime.io/advisories/CVE-2026-72827/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 14 Aug 2026 11:35:35 GMTCVECVE-2026-72824: Grav before 1.0.13 API Key Scope Bypass via PagesControllerhttps://agentprime.io/advisories/CVE-2026-72824/https://agentprime.io/advisories/CVE-2026-72824/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 14 Aug 2026 11:35:33 GMTCVECVE-2026-72823: Grav before 1.0.13 API-key scope cap bypass via DemoControllerhttps://agentprime.io/advisories/CVE-2026-72823/https://agentprime.io/advisories/CVE-2026-72823/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 14 Aug 2026 11:35:32 GMTCVECVE-2026-72822: Grav before 1.0.13 Authentication Bypass via disable2fahttps://agentprime.io/advisories/CVE-2026-72822/https://agentprime.io/advisories/CVE-2026-72822/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 14 Aug 2026 11:35:31 GMTCVE