getgrav
Number 86 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Combines these spellings from source records: Getgrav, getgrav
Total vulnerabilities
212
Critical
16
High
109
Known Exploited
0
Exploit available
3
Network, no login needed
28.8%
Of 212 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 167 | 13 | 85 | 67 | 2 | 0 |
| 2025 | 19 | 0 | 8 | 11 | 0 | 0 |
| 2024 | 7 | 0 | 7 | 0 | 0 | 0 |
| 2023 | 6 | 1 | 4 | 1 | 0 | 0 |
| 2022 | 5 | 1 | 2 | 2 | 0 | 0 |
| 2021 | 8 | 1 | 3 | 4 | 0 | 0 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| grav | 157 | 93 |
| grav-plugin-api | 17 | 15 |
| getgrav/grav | 8 | 4 |
| grav-plugin-login | 6 | 4 |
| grav-plugin-form | 4 | 1 |
| grav-plugin-admin | 3 | 2 |
| getgrav/grav-plugin-admin | 2 | 0 |
| grav-plugin-flex-objects | 2 | 0 |
| grav-plugin-guestbook | 2 | 0 |
| grav-plugin-shortcode-core | 2 | 2 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Cross-Site Scripting | 39 | 9 |
| Missing Authorization | 20 | 11 |
| Code Injection | 18 | 17 |
| Information Disclosure | 16 | 8 |
| Privilege Escalation | 12 | 12 |
| Path Traversal | 11 | 7 |
| Incorrect Authorization | 9 | 7 |
| Authentication Issues | 6 | 6 |
| External Control of File Name or Path | 5 | 4 |
| Improper Handling of Highly Compressed Data (Data Amplification) | 5 | 0 |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-124434 | Grav Lightbox Gallery 1.1.0 before 1.3.2 File Read via Shortcode Media Actions | High | 0.3% | |
| CVE-2026-117604 | Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback | High | 0.3% | |
| CVE-2026-116019 | Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives | High | 0.3% | |
| CVE-2026-114660 | Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives | Medium | 0.2% | |
| CVE-2026-114659 | Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes | Medium | 0.6% | |
| CVE-2026-114658 | Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite | High | 0.3% | |
| CVE-2026-114657 | Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri | Medium | 0.2% | |
| CVE-2026-112782 | Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service | High | 0.8% | |
| CVE-2026-112781 | Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives | Medium | 0.6% | |
| CVE-2026-112780 | Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@ | High | 0.7% |