Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 02:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

144-76% vs 7-day avg of 597

2 critical, 38 high, 59 medium, 25 low

Expand	Severity	Score	Advisory	Title	Source	Published
	High	8.7	CVE-2026-116019	Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with... getgrav, Gravgetgrav grav, Grav	NVD	Oct 24 12:16 UTC
CVE-2026-116019Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-@ directives with... Executive summary The advisory says Grav CMS versions from 2.0.15 before 2.2.13 contain a flaw that lets users with page editing rights run arbitrary public static methods through blueprint directives. The text does not state a severity score. The advisory text does not state a vendor recommendation beyond the fix version shown in the description, so upgrading to 2.2.13 or later is the implied remedy. Technical summary The flaw is an allowlist bypass in Grav's handling of data-@ blueprint directives, which lets a page editor invoke arbitrary public static methods by relocating directives. The advisory excerpt is a source code listing of Blueprint.php with comments describing a fix, and it shows the allowlist and provenance checks that address the issue. The attack precondition is page editor access, and the excerpt does not state a CVSS score, exploitation status, or detection guidance. The affected range is stated as 2.0.15 before 2.2.13, and the fixed version is 2.2.13 as written in the description. Workarounds are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/getgrav/grav/blob/2.2.12/sys…n/Data/Blueprint.php Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects getgrav Grav getgrav grav Grav NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	High	7.0	CVE-2026-114660	Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object... getgravgetgrav grav	NVD	Oct 22 02:16 UTC
CVE-2026-114660Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object... Executive summary A flaw in the Grav content management system, versions 2.0.0 through 2.2.4, lets a user who can write pages delete pages that they and the viewing user are not allowed to delete. The advisory rates the severity as High, and the vendor recommends upgrading to Grav 2.2.5, which contains the fix. Technical summary The issue is an improper access control weakness (CWE-862 Missing Authorization, with CWE-470 Unsafe Reflection) in FlexDirectory::dynamicFlexField(), which runs flex-*@ directives from page frontmatter by calling methods on a Flex object. A page author can store a form whose directives call setStorageKey() and delete(), and these run in the session of a more privileged user who opens the page, so the attack needs that user to view the page. Affected versions are stated as 2.0.0 through 2.2.4 (>= 2.0.0, < 2.2.5), and the patched version is 2.2.5. The advisory says Grav 1.7 has the same code but the fix is not backported to it. No workaround is stated, and no detection guidance is stated. The advisory states no CVSS score, and it says no known CVE exists, although the advisory ID is CVE-2026-114660. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/getgrav/grav/security/adviso…/GHSA-95jr-q4xh-27vr Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects getgrav getgrav grav NIST National Vulnerability DatabasePublished Oct 22, 2026 02:16 UTC Read the advisory
	High	7.1	CVE-2026-114659	Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages... getgrav, Gravgetgrav grav-plugin-flex-objects, Grav Flex Objects plugin, Grav API plugin	NVD	Oct 22 02:16 UTC
CVE-2026-114659Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages... Executive summary A flaw in the Flex Objects plugin for the Grav content platform lets signed-in, non-super accounts with API access read, change, or delete pages they should be blocked from. The advisory rates it Moderate and says the fix is to update Flex Objects to 1.4.17 or, if that is not possible right away, to remove the affected admin permissions or API access from non-super accounts. Technical summary This is an authorization bypass (CWE-863, with CWE-424 alternate path) in the generic /api/v1/flex-objects/pages routes, which check only directory-level admin.pages permissions and skip the per-page api.pages.read and api.pages.write checks and page permissions rules that the Pages API enforces. The attacker needs an authenticated account with api.access plus admin.pages or admin.configuration.pages, and the advisory says it is not a super user account. Affected versions are Flex Objects >= 1.4.0, < 1.4.17 (1.4.0 through 1.4.16), with the fix in 1.4.17. The advisory states that the pages directory is enabled by default and that sites using API plugin 1.0.16 or later are affected when relying on page-level permissions rules. Workarounds are stated: remove admin.pages and admin.configuration.pages from non-super accounts and groups, or remove api.access from accounts that do not need it. The advisory does not state a CVE ID (it says 'No known CVE'), a CVSS score, whether the issue is exploited in the wild, or specific detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/getgrav/grav/security/adviso…/GHSA-2pvc-r9gj-mcpf Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects getgrav Grav getgrav grav-plugin-flex-objects Grav Flex Objects plugin Grav API plugin NIST National Vulnerability DatabasePublished Oct 22, 2026 02:16 UTC Read the advisory
	High	8.7	CVE-2026-114658	Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts getgrav, Gravgetgrav grav-plugin-login, Grav Login plugin	NVD	Oct 22 02:16 UTC
CVE-2026-114658Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts Executive summary The Grav Login plugin, versions 3.6.0 through 3.9.12, has a flaw that lets a page author create a super user account through a login invitation form. The advisory rates it High severity and says the fix is in Login 3.9.13, which the vendor recommends installing. Technical summary This is a missing authorization issue (CWE-862, with related CWE-269) in the login.invite task, where Controller::taskInvite() only checked that a form was active on the page and did not check the sender. The task copied the access level from the page's form.meta.invite.account frontmatter into the invitation with no cap, so a page author can grant super access and anyone who can load the page can submit it without signing in. Affected versions are stated as >= 3.6.0, < 3.9.13 (Login 3.6.0 through 3.9.12), and the patched version is 3.9.13. The advisory states no workaround beyond the fix; it notes that sites restricting the invitation page with access: admin.login should be aware the sender now needs an account management permission. No CVE ID is assigned per the advisory, and no exploitation in the wild or CVSS score is stated. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/getgrav/grav/security/adviso…/GHSA-j8jx-ccrg-m7h2 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects getgrav Grav getgrav grav-plugin-login Grav Login plugin NIST National Vulnerability DatabasePublished Oct 22, 2026 02:16 UTC Read the advisory
	Medium	6.9	CVE-2026-114657	Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credentials through Twig page content getgravgetgrav grav	NVD	Oct 22 02:16 UTC
CVE-2026-114657Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credentials through Twig page content Executive summary A flaw in Grav, a flat-file content management system, lets a page author capture the HTTP Basic usernames and passwords of visitors through Twig code placed in page content. The advisory rates it Moderate and says it affects Grav 2.0.0 through 2.2.4 and is fixed in 2.2.5, which is the recommended action. Sites that do not use HTTP Basic authentication are not affected according to the advisory. Technical summary This is an information disclosure issue (CWE-200 and CWE-522) in which the Twig content sandbox allows toarray and __tostring on the request Uri object, which carried the visitor's PHP_AUTH_USER and PHP_AUTH_PW values. The attacker needs only page-writing rights and a site where visitors use HTTP Basic authentication; the credentials are sent to an attacker-chosen host when a visitor's browser loads an inline style referencing a remote background image. Affected versions are stated as 2.0.0 through 2.2.4, with 2.0.0 to 2.0.18 affected only when security.twig_content.process_enabled was turned on, and fixed version 2.2.5. The advisory states no workaround beyond upgrading, and it notes that Grav 1.7 is not a boundary for this issue. Detection guidance is not stated, and no CVE ID is assigned per the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/getgrav/grav/security/adviso…/GHSA-c85g-q5w4-ff68 Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects getgrav getgrav grav NIST National Vulnerability DatabasePublished Oct 22, 2026 02:16 UTC Read the advisory
	High	8.7	CVE-2026-112782	Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit... getgravgetgrav grav	NVD	Oct 19 20:17 UTC
CVE-2026-112782Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit... From the advisory Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit when system.images.url_actions is enabled. Attackers can send single-dimension or percentage forceResize, zoomCrop, or chained image actions to make GD allocate multi-gigabyte canvases, exhausting server memory and taking the site down. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects getgrav getgrav grav NIST National Vulnerability DatabasePublished Oct 19, 2026 20:17 UTC Read the advisory
	High	8.7	CVE-2026-112781	Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-*@ directives to page... getgravgetgrav grav	NVD	Oct 19 20:17 UTC
CVE-2026-112781Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-@ directives to page... From the advisory Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-@ directives to page frontmatter forms. Attackers with page-edit permission can bypass the Twig sandbox config_denied_paths redaction to expose security.salt, plugin credentials, and Redis passwords to all visitors. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects getgrav getgrav grav NIST National Vulnerability DatabasePublished Oct 19, 2026 20:17 UTC Read the advisory
	Critical	9.3	CVE-2026-112780	Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with... getgravgetgrav grav	NVD	Oct 19 20:17 UTC
CVE-2026-112780Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with... From the advisory Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-*@ directives past the callable check to invoke Folder::delete, Folder::move, or Utils::download, deleting directories, overwriting files, or reading files. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects getgrav getgrav grav NIST National Vulnerability DatabasePublished Oct 19, 2026 20:17 UTC Read the advisory
	Critical	9.3	CVE-2026-112779	Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET... getgravgetgrav grav-plugin-api	NVD	Oct 19 20:17 UTC
CVE-2026-112779Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET... From the advisory Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/{lang} endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy endpoints. Unauthenticated attackers can send small requests that each store about 560 KB to exhaust disk or APCu, while accounts with api.pages.write can overwrite translations or create pages that page-level rules deny. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects getgrav getgrav grav-plugin-api NIST National Vulnerability DatabasePublished Oct 19, 2026 20:17 UTC Read the advisory
	High	8.7	CVE-2026-109326	Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root getgravgetgrav grav	NVD	Oct 12 17:17 UTC
CVE-2026-109326Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root From the advisory Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects, reconstructing unpublished history or committed secrets. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects getgrav getgrav grav NIST National Vulnerability DatabasePublished Oct 12, 2026 17:17 UTC Read the advisory
	High	8.7	CVE-2026-109325	Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values getgravgetgrav grav	NVD	Oct 12 17:17 UTC
CVE-2026-109325Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values From the advisory Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, and queries. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects getgrav getgrav grav NIST National Vulnerability DatabasePublished Oct 12, 2026 17:17 UTC Read the advisory
	High	7.1	CVE-2026-109324	Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images getgravgetgrav grav	NVD	Oct 12 17:17 UTC
CVE-2026-109324Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images From the advisory Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images. Attackers can reference a Twig or Markdown transform so GD or Imagick decodes the full source without dimension checks, letting anonymous requests repeatedly cause page unavailability. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects getgrav getgrav grav NIST National Vulnerability DatabasePublished Oct 12, 2026 17:17 UTC Read the advisory
	Medium	6.9	CVE-2026-109323	Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only vote_access and... getgravgetgrav grav-plugin-star-ratings	NVD	Oct 12 17:17 UTC
CVE-2026-109323Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only vote_access and... From the advisory Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only vote_access and readonly enforcement. Attackers can use the anonymous nonce emitted by getData() to submit votes directly to addVote(), manipulating restricted or disabled ratings and aggregate rating output. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects getgrav getgrav grav-plugin-star-ratings NIST National Vulnerability DatabasePublished Oct 12, 2026 17:17 UTC Read the advisory
	Medium	5.3	CVE-2026-109322	Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message... getgravgetgrav grav-plugin-guestbook	NVD	Oct 12 17:17 UTC
CVE-2026-109322Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message... From the advisory Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other visitors' browsers and, in versions 0.5.0 and 0.5.1, in administrator moderation sessions. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects getgrav getgrav grav-plugin-guestbook NIST National Vulnerability DatabasePublished Oct 12, 2026 17:17 UTC Read the advisory
	Critical	9.3	CVE-2026-109321	Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted... getgravgetgrav grav-plugin-login-oauth	NVD	Oct 12 17:17 UTC
CVE-2026-109321Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted... From the advisory Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess a provider identifier can reproduce these credentials and log in, gaining administrative control of privileged accounts. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects getgrav getgrav grav-plugin-login-oauth NIST National Vulnerability DatabasePublished Oct 12, 2026 17:17 UTC Read the advisory
	Medium	5.3	CVE-2026-109320	The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because... getgravgetgrav grav-plugin-api	NVD	Oct 12 17:17 UTC
CVE-2026-109320The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because... From the advisory The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already authorized browser or remember-me session to call API endpoints until expiry, defeating operator revocation. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects getgrav getgrav grav-plugin-api NIST National Vulnerability DatabasePublished Oct 12, 2026 17:17 UTC Read the advisory
	Medium	5.3	CVE-2026-109319	Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll getgravgetgrav grav-plugin-guestbook	NVD	Oct 12 17:17 UTC
CVE-2026-109319Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll From the advisory Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll. Authenticated Admin users lacking the admin.guestbook permission, or external sites abusing a moderator's session via nonce-less GET requests, can delete or approve Guestbook entries. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects getgrav getgrav grav-plugin-guestbook NIST National Vulnerability DatabasePublished Oct 12, 2026 17:17 UTC Read the advisory
	High	8.6	CVE-2026-109317	Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar... getgravgetgrav grav-plugin-api	NVD	Oct 12 17:17 UTC
CVE-2026-109317Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar... From the advisory Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting permission resolver satisfies requireSuper checks, accessing super-only API endpoints. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects getgrav getgrav grav-plugin-api NIST National Vulnerability DatabasePublished Oct 12, 2026 17:17 UTC Read the advisory
	Medium	6.9	CVE-2026-109316	Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic... getgravgetgrav grav-plugin-datamanager	NVD	Oct 12 17:17 UTC
CVE-2026-109316Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic... From the advisory Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic Admin integration. Attackers can send a request with the delete parameter and known data type and filename to remove files under user/data/, including form submissions, or forge requests lacking CSRF nonce checks. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects getgrav getgrav grav-plugin-datamanager NIST National Vulnerability DatabasePublished Oct 12, 2026 17:17 UTC Read the advisory
	High	7.1	CVE-2026-109315	Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list... getgravgetgrav grav	NVD	Oct 12 17:17 UTC
CVE-2026-109315Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list... From the advisory Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token. Attackers can render the token through editor-authored Twig and supply it as X-Clockwork-Auth to read profiler records with configuration, request metadata, and database queries. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects getgrav getgrav grav NIST National Vulnerability DatabasePublished Oct 12, 2026 17:17 UTC Read the advisory
	High	8.5	CVE-2026-109314	Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route getgravgetgrav grav-plugin-login	NVD	Oct 12 17:17 UTC
CVE-2026-109314Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route From the advisory Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route. When a victim opens an emailed reset link, the publisher-controlled page rendered by Login::getPage() exposes the username and bearer token, enabling takeover of more privileged accounts. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects getgrav getgrav grav-plugin-login NIST National Vulnerability DatabasePublished Oct 12, 2026 17:17 UTC Read the advisory
	High	8.6	CVE-2026-109313	Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through... getgravgetgrav grav-plugin-login	NVD	Oct 12 17:17 UTC
CVE-2026-109313Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through... From the advisory Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as a fully authorized session without completing the second factor. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects getgrav getgrav grav-plugin-login NIST National Vulnerability DatabasePublished Oct 12, 2026 17:17 UTC Read the advisory
	High	8.6	CVE-2026-109312	Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA... getgravgetgrav grav-plugin-login	NVD	Oct 12 17:17 UTC
CVE-2026-109312Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA... From the advisory Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invoke update_user before completing 2FA to disable twofa_enabled and take over the account. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects getgrav getgrav grav-plugin-login NIST National Vulnerability DatabasePublished Oct 12, 2026 17:17 UTC Read the advisory
	High	8.4	CVE-2026-100673	The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view... getgravgetgrav grav-plugin-datamanager	NVD	Sep 26 14:16 UTC
CVE-2026-100673The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view... From the advisory The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view (admin/templates/partials/item.html.twig) without escaping, applying Twig's `raw` filter — in some cases after a striptags('<br>') call that PHP's strip_tags() bypasses by preserving allowed tags together with their attributes. An unauthenticated visitor who submits a front-end form whose submissions are saved to user/data can store an HTML payload that executes as JavaScript in the session and origin of an administrator who later opens that entry in the classic admin panel, running with that administrator's privileges and CSRF token. Execution occurs without further interaction for list values (such as checkbox or multi-select fields) and on hover for ordinary text fields. Sites using the Grav 2.0 Admin Next interface are not affected, because it renders the same data through a separate, correctly escaping code path. The issue is fixed in Data Manager 1.4.5. Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects getgrav getgrav grav-plugin-datamanager NIST National Vulnerability DatabasePublished Sep 26, 2026 14:16 UTC Read the advisory
	High	8.7	CVE-2026-100672	The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check getgravgetgrav grav-plugin-comments	NVD	Sep 26 14:16 UTC
CVE-2026-100672The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check From the advisory The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin(), which only indicates that the admin service is registered on the current route rather than that the visitor is authenticated, and it echoes the JSON and calls exit() during the plugins stage, before the classic Admin plugin would render its login screen. On a site using the classic Admin plugin with Comments enabled (the default), an unauthenticated remote attacker can request /admin/comments/page:<n> (e.g. page:0.001) and retrieve every comment from the last 7 days, including each commenter's email address and the absolute server filesystem path of the data file. Sites running the Grav 2.0 Admin Next stack (admin2 + api) are not affected via this path. The issue is fixed in 1.2.11, which requires an authenticated user with admin.comments or admin.super and removes the absolute filePath from the response. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects getgrav getgrav grav-plugin-comments NIST National Vulnerability DatabasePublished Sep 26, 2026 14:16 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited