CVE Tools
Track your stack

Getgrav

190 CVEs tracked since 2021. Since Apr 2021, none of them reached CISA KEV.

Getgrav CVEs per month

Apr 2021 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Getgrav CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2021-0430
2021-052 or fewer
2021-062 or fewer
2021-072 or fewer
2021-083 or fewer
2021-092 or fewer
2021-102 or fewer
2021-112 or fewer
2021-122 or fewer
2022-012 or fewer
2022-022 or fewer
2022-033 or fewer
2022-043 or fewer
2022-053 or fewer
2022-063 or fewer
2022-073 or fewer
2022-083 or fewer
2022-093 or fewer
2022-102 or fewer
2022-113 or fewer
2022-123 or fewer
2023-013 or fewer
2023-023 or fewer
2023-03no snapshot
2023-043 or fewer
2023-053 or fewer
2023-0650
2023-073 or fewer
2023-084 or fewer
2023-093 or fewer
2023-104 or fewer
2023-114 or fewer
2023-124 or fewer
2024-014 or fewer
2024-024 or fewer
2024-0360
2024-044 or fewer
2024-055 or fewer
2024-064 or fewer
2024-074 or fewer
2024-084 or fewer
2024-093 or fewer
2024-104 or fewer
2024-114 or fewer
2024-123 or fewer
2025-014 or fewer
2025-023 or fewer
2025-035 or fewer
2025-044 or fewer
2025-054 or fewer
2025-064 or fewer
2025-075 or fewer
2025-084 or fewer
2025-094 or fewer
2025-104 or fewer
2025-114 or fewer
2025-12220
2026-015 or fewer
2026-025 or fewer
2026-037 or fewer
2026-046 or fewer
2026-05140
2026-067 or fewer
2026-07380
2026-08660
2026-09220
2026-10140

Products

The products that kept showing up in Getgrav's monthly top three, with their CVEs summed over those months.

  1. Grav1559 months
  2. Grav-plugin-api123 months
  3. Grav-plugin-admin93 months
  4. Grav-plugin-login62 months
  5. Grav-plugin-form42 months
  6. Grav Admin11 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Getgrav.

  1. CVE-2026-114660Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives6.3
  2. CVE-2026-114659Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes6.5
  3. CVE-2026-114658Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite8.8
  4. CVE-2026-114657Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri5.7
  5. CVE-2026-112782Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service7.5
  6. CVE-2026-112781Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives6.5
  7. CVE-2026-112780Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@8.8
  8. CVE-2026-112779Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass9.8
  9. CVE-2026-109326Grav before 2.1.7 Information Disclosure via Nested .git Directories7.5
  10. CVE-2026-109325Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy7.5
  11. CVE-2026-109324Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms6.5
  12. CVE-2026-109322Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views6.1
  13. CVE-2026-109323Grav Star Ratings 2.0.1 through 2.0.3 Missing Server-Side vote_access Authorization5.3
  14. CVE-2026-109321Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass9.1
  15. CVE-2026-109319Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation4.3

The record

Peak rank
#14 in Aug 2026
Busiest month shown
Aug 2026, 66 CVEs
Months with a KEV entry
0 since Apr 2021
Monthly snapshots
9 since 2021
Getgrav's full record, month by month