Vendor
Grav vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 116 vulnerabilities in Grav: 0 in the last 7 days and 58 in the last 90 days, 12 of them critical and 0 exploited in the wild. The most recent, CVE-2026-116019, was published on 24 October 2026. 16 vulnerabilities in the last four weeks, up 220% on the four before (5). 2 critical against 0. 6 technologies have a page of their own.
- Last 7 days
- 0
- Last 90 days
- 58
- Critical, all time
- 12
- Exploited in the wild
- 0
About Grav
Grav is the developer of an open-source flat-file content management system.
Grav technologies
Latest Grav vulnerabilities
- CVE-2026-116019: Grav allowlist bypass in Flex form processinghighCVSS 8.8
- CVE-2026-114660: Grav improper access control in FlexDirectory::dynamicFlexField()mediumCVSS 6.3
- CVE-2026-114659: Grav Flex Objects plugin authorization bypass in pages APImediumCVSS 6.5
- CVE-2026-114658: Grav Login plugin missing authorization in invitation taskhighCVSS 8.8
- CVE-2026-114657: Grav information disclosure via Twig HTTP Basic credentialsmediumCVSS 5.7
- CVE-2026-112782: Grav image pixel limit bypass allows resource exhaustionhighCVSS 7.5
- CVE-2026-112779: Grav API plugin cache exhaustion and authorization bypasscriticalCVSS 9.8
- CVE-2026-109326: Grav information disclosure via nested Git repositorieshighCVSS 7.5EPSS 0.4%
- CVE-2026-109325: Grav Clockwork profiler authentication bypass in loopback checkhighCVSS 7.5EPSS 0.4%
- CVE-2026-109324: Grav memory exhaustion in image transformsmediumCVSS 6.5EPSS 0.3%
- CVE-2026-109322: Grav Guestbook plugin stored cross-site scriptingmediumCVSS 6.1EPSS 0.2%
- CVE-2026-109321: Grav Login OAuth plugin authentication bypass with predictable credentialscriticalCVSS 9.1EPSS 0.4%
- CVE-2026-109320: Grav API plugin session validation bypass in disabled accountsmediumCVSS 5.4EPSS 0.3%
- CVE-2026-109319: Grav Guestbook plugin missing authorization and CSRF in moderationmediumCVSS 4.3EPSS 0.2%
- CVE-2026-109316: Grav Data Manager missing authorization in file deletionmediumCVSS 6.5EPSS 0.3%
- CVE-2026-109315: Grav information disclosure in Clockwork debugger token via Twig sandboxmediumCVSS 6.5EPSS 0.3%
- CVE-2026-100672: Grav Comments plugin unauthenticated information disclosurehighCVSS 7.5
- CVE-2026-100670: Grav CMS blueprint guard bypass privilege escalationhighCVSS 8.8
- CVE-2026-100669: Grav case-insensitive path traversal bypass in access control ruleshighCVSS 7.5
- CVE-2026-92917: Grav Twig sandbox configuration disclosure via print_rhighCVSS 7.5EPSS 0.5%
- CVE-2026-92916: Grav CMS unauthenticated Clockwork profiler information disclosurehighCVSS 7.5EPSS 0.5%
- CVE-2025-64059: Grav stored cross-site scripting in Home Page editorlowCVSS 1.8EPSS 0.3%
- CVE-2026-86196: Grav API Plugin password reset link spoofing via Host headerinfoCVSS 8.7EPSS 0.4%
- CVE-2026-86194: Grav Form Plugin authorization bypass in cross-page form resolutioninfoCVSS 6.9EPSS 0.6%
- CVE-2026-86193: Grav API Plugin authorization bypass in user-management guardsinfoCVSS 8.7EPSS 0.4%
Most severe Grav vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-56700: Grav CMS multiple remote code execution vulnerabilitiescriticalCVSS 9.8EPSS 2.5%
- CVE-2026-80203: Grav API Plugin authorization bypass in user managementcriticalCVSS 9.8EPSS 0.5%
- CVE-2026-56710: Grav Login plugin privilege escalation in unlock handlercriticalCVSS 9.8EPSS 0.5%
- CVE-2026-112779: Grav API plugin cache exhaustion and authorization bypasscriticalCVSS 9.8
- CVE-2026-65008: Grav remote code execution in Blueprint dynamicDatacriticalCVSS 9.8
- CVE-2026-65007: Grav api plugin missing authorization in API key generationcriticalCVSS 9.6
- CVE-2026-61451: Grav API plugin password reset token poisoningcriticalCVSS 9.6
- CVE-2026-42613: Grav Login plugin privilege escalation in registration handlercriticalCVSS 9.4EPSS 0.6%
- CVE-2026-42607: Grav Remote Code Execution via Direct Install ZIP uploadcriticalCVSS 9.1EPSS 2.3%
- CVE-2026-42608: Grav Path Traversal and Arbitrary File Write in FormFlashcriticalCVSS 9.1EPSS 0.5%
Vulnerabilities per week
16 vulnerabilities in the last four weeks, up 220% on the four before (5). 2 critical against 0. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 15 | 1 | |
| 24 Aug 2026 | 15 | 2 | |
| 31 Aug 2026 | 6 | 0 | |
| 7 Sep 2026 | 1 | 0 | |
| 14 Sep 2026 | 2 | 0 | |
| 21 Sep 2026 | 3 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 9 | 1 | |
| 19 Oct 2026 | 7 | 1 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Grav vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/grav)<a href="https://junglewise.ai/threats/vendors/grav"><img src="https://junglewise.ai/threats/vendors/grav/badge.svg" alt="Grav vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/grav.json, and this page as text at https://junglewise.ai/threats/vendors/grav.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Grav vulnerabilities", https://junglewise.ai/threats/vendors/grav, 13 November 2026.