{"schema_version":1,"title":"Grav API Plugin vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 22 vulnerabilities in Grav API Plugin: 0 in the last 7 days and 20 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-86196, was published on 5 September 2026.","url":"https://junglewise.ai/threats/technologies/api-plugin","json_url":"https://junglewise.ai/threats/technologies/api-plugin.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/api-plugin","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":8,"all_time":22,"critical":3,"exploited":0,"last_7_days":0,"last_30_days":2,"last_90_days":20,"last_365_days":22},"latest":[{"cve":"CVE-2026-86196","cvss":8.7,"epss":0.0044,"slug":"cve-2026-86196-grav-api-plugin-password-reset-link-spoofing-via-host-header","title":"Grav API Plugin password reset link spoofing via Host header","severity":"info","exploited":false,"published_at":"2026-09-05T13:18:14.98+00:00","url":"https://junglewise.ai/threats/cve-2026-86196-grav-api-plugin-password-reset-link-spoofing-via-host-header"},{"cve":"CVE-2026-86193","cvss":8.7,"epss":0.0036,"slug":"cve-2026-86193-grav-api-plugin-authorization-bypass-in-user-management-guards","title":"Grav API Plugin authorization bypass in user-management guards","severity":"info","exploited":false,"published_at":"2026-09-05T13:18:14.593+00:00","url":"https://junglewise.ai/threats/cve-2026-86193-grav-api-plugin-authorization-bypass-in-user-management-guards"},{"cve":"CVE-2026-80204","cvss":5.4,"epss":0.0024,"slug":"cve-2026-80204-grav-api-plugin-scope-cap-bypass-in-page-permissions","title":"Grav API Plugin scope cap bypass in page permissions","severity":"medium","exploited":false,"published_at":"2026-08-26T11:16:39.797+00:00","url":"https://junglewise.ai/threats/cve-2026-80204-grav-api-plugin-scope-cap-bypass-in-page-permissions"},{"cve":"CVE-2026-80203","cvss":9.8,"epss":0.0051,"slug":"cve-2026-80203-grav-api-plugin-authorization-bypass-in-user-management","title":"Grav API Plugin authorization bypass in user management","severity":"critical","exploited":false,"published_at":"2026-08-26T11:16:39.647+00:00","url":"https://junglewise.ai/threats/cve-2026-80203-grav-api-plugin-authorization-bypass-in-user-management"},{"cve":"CVE-2026-56708","cvss":5.3,"epss":0.0028,"slug":"cve-2026-56708-grav-api-plugin-server-side-request-forgery-in-webhook-delivery","title":"Grav API plugin server-side request forgery in webhook delivery","severity":"medium","exploited":false,"published_at":"2026-08-25T02:16:42.783+00:00","url":"https://junglewise.ai/threats/cve-2026-56708-grav-api-plugin-server-side-request-forgery-in-webhook-delivery"},{"cve":"CVE-2026-64852","cvss":8.8,"epss":0.0041,"slug":"cve-2026-64852-grav-api-plugin-privilege-escalation-in-api-key-management","title":"Grav API Plugin privilege escalation in API key management","severity":"info","exploited":false,"published_at":"2026-08-19T16:18:40.04+00:00","url":"https://junglewise.ai/threats/cve-2026-64852-grav-api-plugin-privilege-escalation-in-api-key-management"},{"cve":"CVE-2026-63408","cvss":7.5,"epss":0.0049,"slug":"cve-2026-63408-grav-api-plugin-jwt-token-exposure-in-url-query-parameter","title":"Grav API Plugin JWT token exposure in URL query parameter","severity":"high","exploited":false,"published_at":"2026-08-19T16:18:38.013+00:00","url":"https://junglewise.ai/threats/cve-2026-63408-grav-api-plugin-jwt-token-exposure-in-url-query-parameter"},{"cve":"CVE-2026-62668","cvss":6.5,"epss":0.0045,"slug":"cve-2026-62668-grav-api-plugin-server-side-request-forgery-via-webhook","title":"Grav API Plugin server-side request forgery via webhook validation bypass","severity":"info","exploited":false,"published_at":"2026-08-19T16:18:19.317+00:00","url":"https://junglewise.ai/threats/cve-2026-62668-grav-api-plugin-server-side-request-forgery-via-webhook"},{"cve":"CVE-2026-62667","cvss":8.1,"epss":0.0041,"slug":"cve-2026-62667-grav-api-plugin-api-key-scope-bypass","title":"Grav API Plugin API key scope bypass","severity":"high","exploited":false,"published_at":"2026-08-19T16:18:19.177+00:00","url":"https://junglewise.ai/threats/cve-2026-62667-grav-api-plugin-api-key-scope-bypass"},{"cve":"CVE-2026-75833","cvss":4.2,"epss":0.0022,"slug":"cve-2026-75833-grav-api-plugin-open-redirect-via-backslash-bypass","title":"Grav API plugin open redirect via backslash bypass","severity":"medium","exploited":false,"published_at":"2026-08-18T12:19:33.37+00:00","url":"https://junglewise.ai/threats/cve-2026-75833-grav-api-plugin-open-redirect-via-backslash-bypass"},{"cve":"CVE-2026-75832","cvss":4.3,"epss":0.003,"slug":"cve-2026-75832-grav-api-plugin-authorization-bypass-in-blueprintpathresolver","title":"Grav API plugin authorization bypass in BlueprintPathResolver","severity":"medium","exploited":false,"published_at":"2026-08-18T12:19:33.23+00:00","url":"https://junglewise.ai/threats/cve-2026-75832-grav-api-plugin-authorization-bypass-in-blueprintpathresolver"},{"cve":"CVE-2026-65897","cvss":8.8,"slug":"cve-2026-65897-grav-api-plugin-privilege-escalation-in-invitationscontroller","title":"Grav API Plugin privilege escalation in InvitationsController","severity":"high","exploited":false,"published_at":"2026-07-23T12:18:48.18+00:00","url":"https://junglewise.ai/threats/cve-2026-65897-grav-api-plugin-privilege-escalation-in-invitationscontroller"},{"cve":"CVE-2026-65896","cvss":7.1,"slug":"cve-2026-65896-getgrav-grav-api-plugin-path-traversal-in-pagescontroller-move","title":"getgrav Grav API Plugin path traversal in PagesController move endpoint","severity":"high","exploited":false,"published_at":"2026-07-23T12:18:48.05+00:00","url":"https://junglewise.ai/threats/cve-2026-65896-getgrav-grav-api-plugin-path-traversal-in-pagescontroller-move"},{"cve":"CVE-2026-65895","cvss":8.5,"slug":"cve-2026-65895-grav-api-plugin-broken-access-control-in-configcontroller","title":"Grav API Plugin broken access control in ConfigController","severity":"high","exploited":false,"published_at":"2026-07-23T12:18:47.91+00:00","url":"https://junglewise.ai/threats/cve-2026-65895-grav-api-plugin-broken-access-control-in-configcontroller"},{"cve":"CVE-2026-65007","cvss":9.6,"slug":"cve-2026-65007-grav-api-plugin-missing-authorization-in-api-key-generation","title":"Grav api plugin missing authorization in API key generation","severity":"critical","exploited":false,"published_at":"2026-07-21T12:19:00.91+00:00","url":"https://junglewise.ai/threats/cve-2026-65007-grav-api-plugin-missing-authorization-in-api-key-generation"},{"cve":"CVE-2026-62233","cvss":8.8,"slug":"cve-2026-62233-getgrav-grav-plugin-api-privilege-escalation-in-user-management","title":"getgrav grav-plugin-api privilege escalation in user management endpoints","severity":"high","exploited":false,"published_at":"2026-07-17T02:18:10.89+00:00","url":"https://junglewise.ai/threats/cve-2026-62233-getgrav-grav-plugin-api-privilege-escalation-in-user-management"},{"cve":"CVE-2026-62231","cvss":8.1,"slug":"cve-2026-62231-grav-api-plugin-authorization-bypass-in-apikeyauthenticator","title":"Grav API plugin authorization bypass in ApiKeyAuthenticator","severity":"high","exploited":false,"published_at":"2026-07-17T02:18:10.587+00:00","url":"https://junglewise.ai/threats/cve-2026-62231-grav-api-plugin-authorization-bypass-in-apikeyauthenticator"},{"cve":"CVE-2026-61452","cvss":5.3,"slug":"cve-2026-61452-grav-api-plugin-improper-session-invalidation-in-jwt-access","title":"Grav API plugin improper session invalidation in JWT access tokens","severity":"medium","exploited":false,"published_at":"2026-07-15T12:18:20.037+00:00","url":"https://junglewise.ai/threats/cve-2026-61452-grav-api-plugin-improper-session-invalidation-in-jwt-access"},{"cve":"CVE-2026-61451","cvss":9.6,"slug":"cve-2026-61451-grav-api-plugin-password-reset-token-poisoning","title":"Grav API plugin password reset token poisoning","severity":"critical","exploited":false,"published_at":"2026-07-15T12:18:19.897+00:00","url":"https://junglewise.ai/threats/cve-2026-61451-grav-api-plugin-password-reset-token-poisoning"},{"cve":"CVE-2026-61456","cvss":4.6,"slug":"cve-2026-61456-getgrav-grav-api-plugin-stored-xss-via-svg-upload-in-media-api","title":"getgrav Grav API plugin stored XSS via SVG upload in media API","severity":"medium","exploited":false,"published_at":"2026-07-10T15:16:51.023+00:00","url":"https://junglewise.ai/threats/cve-2026-61456-getgrav-grav-api-plugin-stored-xss-via-svg-upload-in-media-api"},{"cve":"CVE-2026-11982","cvss":5.1,"slug":"cve-2026-11982-grav-cms-stored-xss-in-admin2-pages-api","title":"Grav CMS stored XSS in Admin2 Pages API","severity":"info","exploited":false,"published_at":"2026-06-18T17:16:28.093+00:00","url":"https://junglewise.ai/threats/cve-2026-11982-grav-cms-stored-xss-in-admin2-pages-api"},{"cve":"CVE-2026-42843","cvss":8.8,"epss":0.0049,"slug":"cve-2026-42843-grav-api-plugin-privilege-escalation-in-userscontroller","title":"Grav API Plugin privilege escalation in UsersController","severity":"high","exploited":false,"published_at":"2026-05-11T17:16:34.013+00:00","url":"https://junglewise.ai/threats/cve-2026-42843-grav-api-plugin-privilege-escalation-in-userscontroller"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-13","critical":1,"exploited":0,"vulnerabilities":4},{"week":"2026-07-20","critical":1,"exploited":0,"vulnerabilities":4},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":6},{"week":"2026-08-24","critical":1,"exploited":0,"vulnerabilities":3},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Grav","slug":"grav","vulnerabilities":55,"url":"https://junglewise.ai/threats/technologies/grav"},{"name":"Grav Form Plugin","slug":"form-plugin","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/form-plugin"},{"name":"Grav Login Plugin","slug":"login-plugin","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/login-plugin"},{"name":"Grav Flex Objects","slug":"flex-objects","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/flex-objects"}],"technology":{"hub":true,"name":"Grav API Plugin","slug":"api-plugin","vendor":{"name":"Grav","slug":"grav","url":"https://junglewise.ai/threats/vendors/grav"},"aliases":[],"category":"library","homepage":"https://getgrav.org/downloads/plugins","repo_url":"https://github.com/trilbymedia/grav-plugin-api","description":"A plugin for the Grav CMS that provides a RESTful API to interact with the site's content and configuration.","url":"https://junglewise.ai/threats/technologies/api-plugin"},"most_severe":[{"cve":"CVE-2026-80203","cvss":9.8,"epss":0.0051,"slug":"cve-2026-80203-grav-api-plugin-authorization-bypass-in-user-management","title":"Grav API Plugin authorization bypass in user management","severity":"critical","exploited":false,"published_at":"2026-08-26T11:16:39.647+00:00","url":"https://junglewise.ai/threats/cve-2026-80203-grav-api-plugin-authorization-bypass-in-user-management"},{"cve":"CVE-2026-65007","cvss":9.6,"slug":"cve-2026-65007-grav-api-plugin-missing-authorization-in-api-key-generation","title":"Grav api plugin missing authorization in API key generation","severity":"critical","exploited":false,"published_at":"2026-07-21T12:19:00.91+00:00","url":"https://junglewise.ai/threats/cve-2026-65007-grav-api-plugin-missing-authorization-in-api-key-generation"},{"cve":"CVE-2026-61451","cvss":9.6,"slug":"cve-2026-61451-grav-api-plugin-password-reset-token-poisoning","title":"Grav API plugin password reset token poisoning","severity":"critical","exploited":false,"published_at":"2026-07-15T12:18:19.897+00:00","url":"https://junglewise.ai/threats/cve-2026-61451-grav-api-plugin-password-reset-token-poisoning"},{"cve":"CVE-2026-42843","cvss":8.8,"epss":0.0049,"slug":"cve-2026-42843-grav-api-plugin-privilege-escalation-in-userscontroller","title":"Grav API Plugin privilege escalation in UsersController","severity":"high","exploited":false,"published_at":"2026-05-11T17:16:34.013+00:00","url":"https://junglewise.ai/threats/cve-2026-42843-grav-api-plugin-privilege-escalation-in-userscontroller"},{"cve":"CVE-2026-65897","cvss":8.8,"slug":"cve-2026-65897-grav-api-plugin-privilege-escalation-in-invitationscontroller","title":"Grav API Plugin privilege escalation in InvitationsController","severity":"high","exploited":false,"published_at":"2026-07-23T12:18:48.18+00:00","url":"https://junglewise.ai/threats/cve-2026-65897-grav-api-plugin-privilege-escalation-in-invitationscontroller"},{"cve":"CVE-2026-62233","cvss":8.8,"slug":"cve-2026-62233-getgrav-grav-plugin-api-privilege-escalation-in-user-management","title":"getgrav grav-plugin-api privilege escalation in user management endpoints","severity":"high","exploited":false,"published_at":"2026-07-17T02:18:10.89+00:00","url":"https://junglewise.ai/threats/cve-2026-62233-getgrav-grav-plugin-api-privilege-escalation-in-user-management"},{"cve":"CVE-2026-65895","cvss":8.5,"slug":"cve-2026-65895-grav-api-plugin-broken-access-control-in-configcontroller","title":"Grav API Plugin broken access control in ConfigController","severity":"high","exploited":false,"published_at":"2026-07-23T12:18:47.91+00:00","url":"https://junglewise.ai/threats/cve-2026-65895-grav-api-plugin-broken-access-control-in-configcontroller"},{"cve":"CVE-2026-62667","cvss":8.1,"epss":0.0041,"slug":"cve-2026-62667-grav-api-plugin-api-key-scope-bypass","title":"Grav API Plugin API key scope bypass","severity":"high","exploited":false,"published_at":"2026-08-19T16:18:19.177+00:00","url":"https://junglewise.ai/threats/cve-2026-62667-grav-api-plugin-api-key-scope-bypass"},{"cve":"CVE-2026-62231","cvss":8.1,"slug":"cve-2026-62231-grav-api-plugin-authorization-bypass-in-apikeyauthenticator","title":"Grav API plugin authorization bypass in ApiKeyAuthenticator","severity":"high","exploited":false,"published_at":"2026-07-17T02:18:10.587+00:00","url":"https://junglewise.ai/threats/cve-2026-62231-grav-api-plugin-authorization-bypass-in-apikeyauthenticator"},{"cve":"CVE-2026-63408","cvss":7.5,"epss":0.0049,"slug":"cve-2026-63408-grav-api-plugin-jwt-token-exposure-in-url-query-parameter","title":"Grav API Plugin JWT token exposure in URL query parameter","severity":"high","exploited":false,"published_at":"2026-08-19T16:18:38.013+00:00","url":"https://junglewise.ai/threats/cve-2026-63408-grav-api-plugin-jwt-token-exposure-in-url-query-parameter"}],"generated_at":"2026-09-26T19:07:00.176898+00:00"}