Where
-Infinity
0

Trending

Last week
Last month
Last year

getgrav gravGrav before 2.0.9 Remote Code Execution via FlexDirectory

Risk 79
Severity
8.7
First published (updated )
CVE-2026-65608

getgrav gravGrav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()

Risk 36
Severity
6.9
First published (updated )
CVE-2026-59193

Grav GravGrav - Cross-Site Scripting in Admin Plugin Page Editor

Risk 34
Severity
5.1
First published (updated )
CVE-2020-37256

getgrav gravGrav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()

Risk 44
Severity
7.7
First published (updated )
CVE-2026-44738

composer/getgrav/gravGrav: Low-privileged API users can create super-admin accounts via blueprint-upload

Risk 79
Severity
8.7
First published (updated )
CVE-2026-42844
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

getgrav gravGrav: Stored XSS via Tag Injection

Risk 70
Severity
8.9
First published (updated )
CVE-2026-42611

getgrav gravGrav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.

Risk 66
Severity
8.8
First published (updated )
CVE-2026-42608

getgrav gravGrav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic

Risk 60
Severity
8.1
First published (updated )
CVE-2026-42609

getgrav gravGrav: Publisher-Level Stored XSS via Unquoted Event Attributes

Risk 55
Severity
8.5
First published (updated )
CVE-2026-42612

getgrav gravGrav: Sensitive Information Disclosure via Accounts Service Bypass

Risk 38
Severity
6.5
First published (updated )
CVE-2026-42610
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

getgrav gravGrav: Stored XSS via Markdown media attribute() action in Grav CMS

Risk 40
Severity
6.9
First published (updated )
CVE-2026-42841

Grav Grav CMSXEE

Risk 58
Severity
7.6
First published (updated )
CVE-2026-29924

GravCMS GravCMSGravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)

Risk 86
Severity
9.8
First published (updated )
CVE-2021-47812

gravXSS

Risk 34
Severity
5.4
First published (updated )
CVE-2025-66843

gravSSRF

Risk 66
Severity
9.1
First published (updated )
CVE-2025-66844
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

getgrav gravGrav vulnerable to Information Disclosure via IDOR in Grav Admin Panel

Risk 38
Severity
6.5
First published (updated )
CVE-2025-66306

getgrav gravGrav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter

Risk 36
Severity
6.9
First published (updated )
CVE-2025-66305

getgrav gravGrav Exposes Password Hashes Leading to privilege escalation

Risk 66
Severity
7.2
First published (updated )
CVE-2025-66304

getgrav gravGrav is vulnerable to a DOS on the admin panel

Risk 30
Severity
4.9
First published (updated )
CVE-2025-66303

getgrav gravGrav vulnerable to Path Traversal allowing server files backup

Risk 37
Severity
6.8
First published (updated )
CVE-2025-66302
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

getgrav gravGrav ihas Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions

Risk 68
Severity
9.6
First published (updated )
CVE-2025-66301

getgrav gravGrav is vulnerable to Arbitrary File Read

Risk 55
Severity
8.5
First published (updated )
CVE-2025-66300

getgrav gravSecurity Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMS

Risk 79
Severity
8.8
First published (updated )
CVE-2025-66299

getgrav gravGrav is vulnerable to Server-Side Template Injection (SSTI) via Forms

Risk 44
Severity
7.7
First published (updated )
CVE-2025-66298

getgrav gravGrav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection

Risk 79
Severity
8.8
First published (updated )
CVE-2025-66297
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

getgrav gravGrav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover

Risk 79
Severity
8.8
First published (updated )
CVE-2025-66296

getgrav gravGrav is vulnerable to RCE via SSTI through Twig Sandbox Bypass

Risk 79
Severity
8.8
First published (updated )
CVE-2025-66294

getgrav gravGrav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption

Risk 79
Severity
8.8
First published (updated )
CVE-2025-66295

getgrav GravServer-side Template Injection (SSTI) in grav

Risk 80
Severity
8.8
First published (updated )
CVE-2023-37897

getgrav GravGrav vulnerable to Self Cross Site Scripting in /forgot_password

Risk 38
Severity
6.1
First published (updated )
CVE-2023-34452
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203