# Grav vulnerabilities Source: https://junglewise.ai/threats/vendors/grav Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/grav.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 116 vulnerabilities in Grav: 0 in the last 7 days and 58 in the last 90 days, 12 of them critical and 0 exploited in the wild. The most recent, CVE-2026-116019, was published on 24 October 2026. 16 vulnerabilities in the last four weeks, up 220% on the four before (5). 2 critical against 0. 6 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 7 - Last 90 days: 58 - All time: 116 (12 critical, 0 exploited in the wild) ## About Grav Grav is the developer of an open-source flat-file content management system. ## Latest Grav vulnerabilities - [CVE-2026-116019: Grav allowlist bypass in Flex form processing](https://junglewise.ai/threats/cve-2026-116019-grav-2-0-15-before-2-2-13-contains-an-allowlist-bypass) (high, CVSS 8.8, published 24 Oct 2026) - [CVE-2026-114660: Grav improper access control in FlexDirectory::dynamicFlexField()](https://junglewise.ai/threats/cve-2026-114660-grav-from-2-0-0-before-2-2-5-contains-an-improper-access-control) (medium, CVSS 6.3, published 22 Oct 2026) - [CVE-2026-114659: Grav Flex Objects plugin authorization bypass in pages API](https://junglewise.ai/threats/cve-2026-114659-grav-flex-objects-plugin-1-4-0-before-1-4-17-contains-an) (medium, CVSS 6.5, published 22 Oct 2026) - [CVE-2026-114658: Grav Login plugin missing authorization in invitation task](https://junglewise.ai/threats/cve-2026-114658-grav-login-plugin-from-3-6-0-before-3-9-13-contains-a-missing) (high, CVSS 8.8, published 22 Oct 2026) - [CVE-2026-114657: Grav information disclosure via Twig HTTP Basic credentials](https://junglewise.ai/threats/cve-2026-114657-grav-from-2-0-0-before-2-2-5-contains-an-information-disclosure) (medium, CVSS 5.7, published 22 Oct 2026) - [CVE-2026-112782: Grav image pixel limit bypass allows resource exhaustion](https://junglewise.ai/threats/cve-2026-112782-grav-1-7-53-before-1-7-53-5-and-2-0-0-rc-8-before-2-2-2-contains) (high, CVSS 7.5, published 19 Oct 2026) - [CVE-2026-112779: Grav API plugin cache exhaustion and authorization bypass](https://junglewise.ai/threats/cve-2026-112779-grav-api-plugin-grav-plugin-api-1-0-40-before-1-0-42-caches-a) (critical, CVSS 9.8, published 19 Oct 2026) - [CVE-2026-109326: Grav information disclosure via nested Git repositories](https://junglewise.ai/threats/cve-2026-109326-grav-before-2-1-7-contains-an-information-disclosure) (high, CVSS 7.5, published 12 Oct 2026) - [CVE-2026-109325: Grav Clockwork profiler authentication bypass in loopback check](https://junglewise.ai/threats/cve-2026-109325-grav-from-2-0-22-before-2-1-7-contains-an-authentication-bypass) (high, CVSS 7.5, published 12 Oct 2026) - [CVE-2026-109324: Grav memory exhaustion in image transforms](https://junglewise.ai/threats/cve-2026-109324-grav-before-2-1-7-contains-a-denial-of-service-vulnerability) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109322: Grav Guestbook plugin stored cross-site scripting](https://junglewise.ai/threats/cve-2026-109322-grav-guestbook-plugin-before-0-5-2-contains-a-stored-cross-site) (medium, CVSS 6.1, published 12 Oct 2026) - [CVE-2026-109321: Grav Login OAuth plugin authentication bypass with predictable credentials](https://junglewise.ai/threats/cve-2026-109321-grav-login-oauth-plugin-grav-plugin-login-oauth-before-1-4-3) (critical, CVSS 9.1, published 12 Oct 2026) - [CVE-2026-109320: Grav API plugin session validation bypass in disabled accounts](https://junglewise.ai/threats/cve-2026-109320-the-grav-api-plugin-grav-plugin-api-before-1-0-36-contains-an) (medium, CVSS 5.4, published 12 Oct 2026) - [CVE-2026-109319: Grav Guestbook plugin missing authorization and CSRF in moderation](https://junglewise.ai/threats/cve-2026-109319-grav-guestbook-plugin-0-5-0-and-0-5-1-contains-missing) (medium, CVSS 4.3, published 12 Oct 2026) - [CVE-2026-109316: Grav Data Manager missing authorization in file deletion](https://junglewise.ai/threats/cve-2026-109316-grav-data-manager-plugin-1-4-0-through-1-4-5-contains-a-missing) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109315: Grav information disclosure in Clockwork debugger token via Twig sandbox](https://junglewise.ai/threats/cve-2026-109315-grav-from-2-0-22-before-2-1-7-contains-an-information-disclosure) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-100672: Grav Comments plugin unauthenticated information disclosure](https://junglewise.ai/threats/cve-2026-100672-the-comments-plugin-getgrav-grav-plugin-comments-for-grav-cms) (high, CVSS 7.5, published 26 Sep 2026) - [CVE-2026-100670: Grav CMS blueprint guard bypass privilege escalation](https://junglewise.ai/threats/cve-2026-100670-grav-cms-2-0-14-through-2-0-24-contains-a-privilege-escalation) (high, CVSS 8.8, published 26 Sep 2026) - [CVE-2026-100669: Grav case-insensitive path traversal bypass in access control rules](https://junglewise.ai/threats/cve-2026-100669-grav-before-2-0-25-ships-web-server-configuration-samples-whose) (high, CVSS 7.5, published 26 Sep 2026) - [CVE-2026-92917: Grav Twig sandbox configuration disclosure via print_r](https://junglewise.ai/threats/cve-2026-92917-grav-twig-sandbox-configuration-disclosure-via-print-r) (high, CVSS 7.5, published 17 Sep 2026) - [CVE-2026-92916: Grav CMS unauthenticated Clockwork profiler information disclosure](https://junglewise.ai/threats/cve-2026-92916-grav-cms-unauthenticated-clockwork-profiler-information) (high, CVSS 7.5, published 17 Sep 2026) - [CVE-2025-64059: Grav stored cross-site scripting in Home Page editor](https://junglewise.ai/threats/cve-2025-64059-grav-stored-cross-site-scripting-in-home-page-editor) (low, CVSS 1.8, published 13 Sep 2026) - [CVE-2026-86196: Grav API Plugin password reset link spoofing via Host header](https://junglewise.ai/threats/cve-2026-86196-grav-api-plugin-password-reset-link-spoofing-via-host-header) (info, CVSS 8.7, published 5 Sep 2026) - [CVE-2026-86194: Grav Form Plugin authorization bypass in cross-page form resolution](https://junglewise.ai/threats/cve-2026-86194-grav-form-plugin-authorization-bypass-in-cross-page-form) (info, CVSS 6.9, published 5 Sep 2026) - [CVE-2026-86193: Grav API Plugin authorization bypass in user-management guards](https://junglewise.ai/threats/cve-2026-86193-grav-api-plugin-authorization-bypass-in-user-management-guards) (info, CVSS 8.7, published 5 Sep 2026) ## Most severe Grav vulnerabilities - [CVE-2026-56700: Grav CMS multiple remote code execution vulnerabilities](https://junglewise.ai/threats/cve-2026-56700-grav-cms-multiple-remote-code-execution-vulnerabilities) (critical, CVSS 9.8, published 30 Jun 2026) - [CVE-2026-80203: Grav API Plugin authorization bypass in user management](https://junglewise.ai/threats/cve-2026-80203-grav-api-plugin-authorization-bypass-in-user-management) (critical, CVSS 9.8, published 26 Aug 2026) - [CVE-2026-56710: Grav Login plugin privilege escalation in unlock handler](https://junglewise.ai/threats/cve-2026-56710-grav-login-plugin-privilege-escalation-in-unlock-handler) (critical, CVSS 9.8, published 25 Aug 2026) - [CVE-2026-112779: Grav API plugin cache exhaustion and authorization bypass](https://junglewise.ai/threats/cve-2026-112779-grav-api-plugin-grav-plugin-api-1-0-40-before-1-0-42-caches-a) (critical, CVSS 9.8, published 19 Oct 2026) - [CVE-2026-65008: Grav remote code execution in Blueprint dynamicData](https://junglewise.ai/threats/cve-2026-65008-grav-remote-code-execution-in-blueprint-dynamicdata) (critical, CVSS 9.8, published 21 Jul 2026) - [CVE-2026-65007: Grav api plugin missing authorization in API key generation](https://junglewise.ai/threats/cve-2026-65007-grav-api-plugin-missing-authorization-in-api-key-generation) (critical, CVSS 9.6, published 21 Jul 2026) - [CVE-2026-61451: Grav API plugin password reset token poisoning](https://junglewise.ai/threats/cve-2026-61451-grav-api-plugin-password-reset-token-poisoning) (critical, CVSS 9.6, published 15 Jul 2026) - [CVE-2026-42613: Grav Login plugin privilege escalation in registration handler](https://junglewise.ai/threats/cve-2026-42613-grav-login-plugin-privilege-escalation-in-registration-handler) (critical, CVSS 9.4, published 11 May 2026) - [CVE-2026-42607: Grav Remote Code Execution via Direct Install ZIP upload](https://junglewise.ai/threats/cve-2026-42607-grav-remote-code-execution-via-direct-install-zip-upload) (critical, CVSS 9.1, published 11 May 2026) - [CVE-2026-42608: Grav Path Traversal and Arbitrary File Write in FormFlash](https://junglewise.ai/threats/cve-2026-42608-grav-path-traversal-and-arbitrary-file-write-in-formflash) (critical, CVSS 9.1, published 11 May 2026) ## Vulnerabilities per week 16 vulnerabilities in the last four weeks, up 220% on the four before (5). 2 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 15 | 1 | 0 | | 24 Aug 2026 | 15 | 2 | 0 | | 31 Aug 2026 | 6 | 0 | 0 | | 7 Sep 2026 | 1 | 0 | 0 | | 14 Sep 2026 | 2 | 0 | 0 | | 21 Sep 2026 | 3 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 9 | 1 | 0 | | 19 Oct 2026 | 7 | 1 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Grav technologies - [Grav](https://junglewise.ai/threats/technologies/grav): 63 vulnerabilities - [Grav API Plugin](https://junglewise.ai/threats/technologies/api-plugin): 24 vulnerabilities - [Grav Login Plugin](https://junglewise.ai/threats/technologies/login-plugin): 5 vulnerabilities - [Grav Form Plugin](https://junglewise.ai/threats/technologies/form-plugin): 4 vulnerabilities - [Grav Flex Objects](https://junglewise.ai/threats/technologies/flex-objects): 3 vulnerabilities - [Grav CMS](https://junglewise.ai/threats/technologies/grav-cms-1): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Grav vulnerabilities", https://junglewise.ai/threats/vendors/grav, 13 November 2026.